Methods and Arrangements for Encryption of Group Addressed Management Frames

This application also is a continuation of and claims priority to U.S. Application No. 18/129,384, filed Mar. 31, 2023 entitled “METHODS AND ARRANGEMENTS FOR ENCRYPTION OF GROUP ADDRESSED MANAGEMENT FRAMES”, which claims priority under 35 USC §119 from U.S. Provisional Application No. 63/399,116, entitled “GROUP ADDRESSED MANAGEMENT FRAME ENCRYPTION”, filed on Aug. 18, 2022, the subject matter of which is incorporated herein by reference in their entireties.

This disclosure generally relates to methods and arrangements for wireless communications and, more particularly, for encrypting group addressed frames for, e.g., mobile privacy.

Mobile device users commonly use mobile phones as access points for other devices owned by a user or for sharing Internet access or other network access amongst multiple mobile device users. For instance, a user may have a laptop, a tablet, and/or a watch that can communicate via the Internet but does not have access to the Internet if Wi-Fi is unavailable. In such circumstances, the user may execute code (such as a Soft AP) on a mobile device such as a mobile phone that operates as a mobile access point (AP) and that does have access to the Internet through, e.g., a cellular network or a satellite network. Thereafter, one or more mobile devices owned by the user or other users may connect to via the mobile AP.

The association process with such a mobile AP may involve the exchange of one or more management frames such as beacon frames, probe request frames, and/or probe response frames. In many situations, the mobile AP exchanges persistent identifiers referred to as personally identifiable information (PII) in unprotected broadcast frames such as a service set identifier (SSID), a basic service set identifier (BSSID), and/or another medium access control (MAC) address in MAC headers and/or a basic service set (BSS) color in a physical layer (PHY) preamble.

The persistent identifiers and/or other elements in such unprotected frames may offer sufficient information to create a unique fingerprint or signature for a mobile device so the mobile device can be identified and tracked.

The following description and the drawings sufficiently illustrate specific embodiments to enable those skilled in the art to practice them. Other embodiments may incorporate structural, logical, electrical, process, algorithm, and other changes. Portions and features of some embodiments may be included in, or substituted for, those of other embodiments. Embodiments set forth in the claims encompass all available equivalents of those claims.

Embodiments may facilitate communications by stations (STAs) in accordance with different versions of Institute of Electrical and Electronics Engineers (IEEE) 802.11 standards for wireless communications such as IEEE P802.11bi, P802.11be™/D3.0, January 2023; IEEE 802.11-2020, December 2020; IEEE P802.11REVmd/D2.1, February 2019; IEEE P802.11ax™-2021, May 2021; IEEE P802.11ay™-2021, July 2021; IEEE P802.11az™/D3.0, IEEE P802.11ba™-2021, October 2021; IEEE P802.11bb™/D0.4, IEEE P802.11bc™/D1.02, and IEEE P802.11bd™/D1.1.

Embodiments may address the privacy leakage of unprotected group addressed management frames. There are currently many group addressed management frames, such as multicast-group addressed frames and broadcast frames, that are sent in clear that do not create privacy issue for the connecting client, but can create privacy issues for the mobile AP itself.

Examples of group addressed management frames that are sent in clear include a Beacon frame, Probe Response frame, fast initial link setup (FILS) discovery frame, Open Programmability System (OPS) frame, etc. Beacon frames and Probe Response frames, for example, have a number of elements that may include personal identifier information (PII) or personal correlation information (PCI) that may be used for element fingerprinting. However, encrypting such frames is difficult because each of these frames may have a timing synchronization function (TSF) value that is inserted into the frame right before the frame is transmitted. For instance, the TSF value for the FILS discovery frame may be the value of the TSF timer of a mobile AP device in a timestamp field at the time that the start of the data symbol containing the first bit of the timestamp field appears at the transmit antenna connector. The TSF value for a Probe response frame may be the value of the TSF timer of a mobile AP device in a timestamp field at the time that the start of the data symbol containing the first bit of the timestamp field appears at the transmit antenna connector. And the TSF value for a beacon frame may be the value of the TSF timer of a mobile AP device in a timestamp field at the time that the start of the data symbol containing the first bit of the timestamp field appears at the transmit antenna connector.

The FILS discovery and OPS frame do not have rich number of elements, but elements like a traffic indication map (TIM) element, an OPS element, a target wake time (TWT) element, and a transmit power envelope element has information that may be used for element fingerprinting.

Some management type, action subtype frames may include PII such as wireless networking management fast initial link setup (FILS) frames. Embodiments may protect such action frames with the same cipher suites and keys defined for group addressed management frames.

The IEEE 802.11-2020 standard includes a broadcast/multicast integrity protocol (BIP) that introduces a message integrity code (MIC) for authentication via data integrity and replay protection but does not encrypt group addressed management frames such as beacon frames, probe response frames, OPS frames, FILS discovery frames, and the like.

Embodiments may, advantageously, use the mechanisms in the 802.11 standards such as robust security network (RSN) association (RSNA) for communication of, or other provision of, one or more keys related to the BIP, such as a beacon integrity group temporal key (BIGTK) and a group temporal key (GTK), but creates a new key for encryption of the group addressed management frames and/or repurposes one or more of the keys from authentication with a message integrity code (MIC) to encryption of the group addressed management frames. Reuse of one or more keys related to BIP may involve use of a field for a cipher suite for the BIP to define a cipher suite for encryption of group addressed management frames that may be used in conjunction with the one or more keys for encryption of group addressed management frames. The alternative definition of the cipher suites from the BIP cipher suites to encryption cipher suites may signal the use of the cipher suite and keys for encryption/decryption of group addressed management frames rather than for BIP protection.

Reuse of the RSN mechanisms may advantageously encourage wide-spread use of the encryption to protect private personal information. For example, some embodiments may encrypt the frame body of beacon frames, probe response frames, FILS discovery frames, OPS frames, and the like, that do not include TSF values in a timestamp field in the frame body. Some embodiments may encrypt the frame body of frames that include a TSF value in the frame header or otherwise pre-pended or appended to the frame body.

Embodiments may advantageously define one or more keys for use together with cipher suites to encrypt group addressed management frames, define delivery methods to deliver the one or more keys, and define group addressed management frames that can be encrypted with the one or more keys. Some embodiments may advantageously address privacy issues for potential group addressed management frames with or without TSF values in a timestamp field carried in the group addressed management frame. Some embodiments advantageously may define standard methods to deliver and update the one or more keys without requiring a secure out-of-band channel.

Some embodiments may use one key in conjunction with cipher suites to encrypt some or all group addressed management frames including robust group addressed management type action frames. Such embodiments may use a management frame group temporal key (MFGTK) and define a separate replay counter to check for replay of encrypted group addressed management frames. Non-AP STAs may implement a replay counter to compare a replay counter value in an encrypted group addressed frame against a replay counter value maintained by the non-AP STA to check for a replay of the same encrypted group addressed frame.

In many embodiments, the mobile AP may communicate a MFGTK in a key field of a key descriptor element (KDE) of a management frame such as an Extensible Authentication Protocol over LANs (EAPOL)-key message to a non-AP STA, after authentication via, e.g., a pairwise key exchange such as a four-way handshake to establish temporal keys for encryption of the key data. Some embodiments may communicate the MFGTK in a key field of a or in a MFGTK subelement of a fast basic service set (BSS) transition element (FTE), a wireless network management (WNM) sleep mode response frame, and/or other frame.

Some embodiments may implement more than one key to accommodate, e.g., additional BSSs such as a group temporal key (GTK). For instance, if a user wants to establish a mobile access point (AP) for a protected network and one or more other networks such as guest networks, the user may establish one or more secondary BSSs for the one or more other networks and may establish a GTK for links associated with each of the one or more secondary BSSs.

In some embodiments, the mobile device and one or more of the other devices may include multi-link operation (MLO) devices. In such embodiments, an MTGK or GTK may be established for each link of the multi-link devices. In other embodiments, the mobile AP may comprise a multi-band device and may implement an MTGK or GTK for each BSS on the band.

The above descriptions are for purposes of illustration and are not meant to be limiting. Numerous other examples, configurations, processes, algorithms, etc., may exist, some of which are described in greater detail below. Example embodiments will now be described with reference to the accompanying figures.

Various embodiments may be designed to address different technical problems associated with protecting personally identifiable information (PII) for mobile APs; encrypting group addressed frames, defining cipher suites for use with one or more keys for encrypting group addressed management frames; defining one or more keys to use together with the cipher suites to encrypt group addressed management frames; defining a delivery method for one or more keys and cipher suites to encrypt group addressed frames; defining the group addressed management frames that can be encrypted with the one or more keys and cipher suites; defining a delivery method for cipher suites to use together with the one or more keys to encrypt group addressed management frames; defining mechanisms and procedures for detecting replay attacks associated with the one or more keys to encrypt group addressed management frames; defining KDEs and/or subelements for the one or more keys; and/or the like.

Different technical problems such as those discussed above may be addressed by one or more different embodiments. Embodiments may address one or more of these problems associated with protecting personally identifiable information (PII) for mobile APs. For instance, some embodiments that address problems associated with protecting PII for mobile APs may do so by one or more different technical means, such as, generating a management frame comprising a robust security network (RSN) element (RSNE), the management frame comprising a cipher suite for use with a key for encryption of group addressed management frames, the cipher suite used together with a set of one or more keys to encrypt the group addressed management frames; cause transmission of the management frame to one or more stations (STAs); generating a management frame with a KDE for a MFGTK such as a EAPOL-key message, a fast BSS transition frame, a wireless network management (WNM) sleep mode response frame, or other management frame; defining a replay counter for the MFGTK to check for replay of an encrypted group addressed management frame; generating a MLO KDE for the MFGTK; generating a MFGTK subelement for the MFGTK; generating a linkID field in a MLO-MFGTK KDE and/or in a MFGTK subelement to identify a link associated with the MFGTK; encrypting one or more group addressed management fames for transmission; decoding a management frame comprising a robust security network (RSN) element (RSNE), the management frame comprising a cipher suite for use with one or more keys for encryption of group addressed management frames, the cipher suite used together with a set of one or more keys to encrypt the group addressed management frames; receiving the management frame; decoding a management frame with a KDE for a MFGTK such as a EAPOL-key message, a fast BSS transition frame, a fast initial link setup (FILS) frame, or other management frame; storing a replay count for the MFGTK; decoding a MLO KDE for the MFGTK; generating a MFGTK subelement with a key field for the MFGTK; decoding a linkID field in a MLO-MFGTK KDE or a MFGTK subelement to identify a link associated with the MFGTK; decrypting one or more group addressed management frames; and/or the like.

Several embodiments comprise central servers, access points (APs), and/or stations (STAs) such as modems, routers, switches, servers, workstations, netbooks, mobile devices (Laptop, Smart Phone, Tablet, and the like), sensors, meters, controls, instruments, monitors, home or office appliances, Internet of Things (IoT) gear (watches, glasses, headphones, and the like), and the like. Some embodiments may provide, e.g., indoor and/or outdoor “smart” grid and sensor services. In various embodiments, these devices relate to specific applications such as healthcare, home, commercial office and retail, security, and industrial automation and monitoring applications, as well as vehicle applications (automobiles, self-driving vehicles, airplanes, and the like), and the like.

Embodiments may facilitate wireless communications in accordance with multiple standards. Some embodiments may comprise low power wireless communications like Bluetooth®, cellular communications, and messaging systems. Furthermore, some wireless embodiments may incorporate a single antenna while other embodiments may employ multiple antennas or antenna elements.

While some of the specific embodiments described below will reference the embodiments with specific configurations, those of skill in the art will realize that embodiments of the present disclosure may advantageously be implemented with other configurations with similar issues or problems.

1 FIG.A 1000 1020 1006 1005 1020 system diagram illustrating an embodiment of a network environment for encryption logic circuitry. Wireless networkmay include one or more user devices, a mobile access point (AP), and one or more access points(s) (AP), which may communicate in accordance with IEEE 802.11 communication standards. The user device(s)may comprise mobile devices that are non-stationary (e.g., not having fixed locations) and/or stationary devices.

1006 1006 1020 1024 1026 1028 1010 1005 1006 1005 1010 1012 1006 1020 1005 1006 The mobile APmay be a station (STA) with a distribution system access function (DSAF). The mobile APmay be a mobile device such as a cellular phone, a satellite phone, a tablet, a laptop, and/or the like, and may provide access for the user devicesto the distribution system services, via the wireless medium (WM) for associated STAs,, and. For example, a usermay have a mobile device with access to a cellular data system via the AP. The mobile device may be configured to operate as a mobile APto provide, e.g., cellular data network access via the APto other devices carried by the usersuch as a watch, a tablet, a laptop, and/or the like, and/or other users’devices in proximity to the mobile AP. In such circumstances, for instance, the user device(s)may not be capable of or may not currently be configured to access the cellular data network via the APdirectly. Note that the mobile APis not limited to devices commonly considered to be mobile.

1020 1006 1005 3 FIG. 5 6 7 8 FIGS.,,, and In some embodiments, the user devices, the mobile AP, and the APmay include one or more computer systems similar to that of the functional diagram ofand/or the example machine/system of.

1020 1006 1005 1010 1012 1006 1005 One or more illustrative user device(s), the mobile AP, and the APmay be operable by the userand/or the user(s)as STAs that may associate with the mobile APto gain access to network services offered by the AP. It should be noted that any addressable unit may be a STA. A STA may take on multiple distinct characteristics, each of which shape its function.

1020 1006 1005 1020 1006 1005 1020 1024 1026 1028 1006 1005 1020 1006 1005 For example, a single addressable unit might simultaneously be a portable STA, a quality-of-service (QoS) STA, a dependent STA, and a hidden STA. The one or more illustrative user device(s), the mobile AP, and the APmay be STAs. The one or more illustrative user device(s), the mobile AP, and/or the APmay operate as a personal basic service set (PBSS) control point/access point (PCP/AP). The user device(s)(e.g.,,, or), the mobile AP, and/or the APmay include any suitable processor-driven device including, but not limited to, a mobile device or a non-mobile, e.g., a static device. For example, user device(s), the mobile AP, and/or the APmay include, a user equipment (UE), a station (STA), an access point (AP), a software enabled AP (SoftAP), a personal computer (PC), a wearable wireless device (e.g., bracelet, watch, glasses, ring, etc.), a desktop computer, a mobile computer, a laptop computer, an ultrabookTM computer, a notebook computer, a tablet computer, a server computer, a handheld computer, a handheld device, an internet of things (IoT) device, a sensor device, a PDA device, a handheld PDA device, an on-board device, an off-board device, a hybrid device (e.g., combining cellular phone functionalities with PDA device functionalities), a consumer device, a vehicular device, a non-vehicular device, a mobile or portable device, a non-mobile or non-portable device, a mobile phone, a cellular telephone, a PCS device, a PDA device which incorporates a wireless network interface, a mobile or portable GPS device, a DVB device, a relatively small computing device, a non-desktop computer, a “carry small live large” (CSLL) device, an ultra mobile device (UMD), an ultra mobile PC (UMPC), a mobile internet device (MID), an “origami” device or computing device, a device that supports dynamically composable computing (DCC), a context-aware device, a video device, an audio device, an A/V device, a set-top-box (STB), a blu-ray disc (BD) player, a BD recorder, a digital video disc (DVD) player, a high definition (HD) DVD player, a DVD recorder, a HD DVD recorder, a personal video recorder (PVR), a broadcast HD receiver, a video source, an audio source, a video sink, an audio sink, a stereo tuner, a broadcast radio receiver, a flat panel display, a personal media player (PMP), a digital video camera (DVC), a digital audio player, a speaker, an audio receiver, an audio amplifier, a gaming device, a data source, a data sink, a digital still camera (DSC), a media player, a smartphone, a television, a music player, or the like. Other devices, including smart devices such as lamps, climate control, car components, household components, appliances, etc. may also be included in this list.

As used herein, the term “Internet of Things (IoT) device” is used to refer to any object (e.g., an appliance, a sensor, etc.) that has an addressable interface (e.g., an Internet protocol (IP) address, a Bluetooth identifier (ID), a near-field communication (NFC) ID, etc.) and can transmit information to one or more other devices over a wired or wireless connection. An IoT device may have a passive communication interface, such as a quick response (QR) code, a radio-frequency identification (RFID) tag, an NFC tag, or the like, or an active communication interface, such as a modem, a transceiver, a transmitter-receiver, or the like. An IoT device can have a particular set of attributes (e.g., a device state or status, such as whether the IoT device is on or off, open or closed, idle or active, available for task execution or busy, and so on, a cooling or heating function, an environmental monitoring or recording function, a light-emitting function, a sound-emitting function, etc.) that can be embedded in and/or controlled/monitored by a central processing unit (CPU), microprocessor, ASIC, or the like, and configured for connection to an IoT network such as a local ad-hoc network or the Internet. For example, IoT devices may include, but are not limited to, refrigerators, toasters, ovens, microwaves, freezers, dishwashers, dishes, hand tools, clothes washers, clothes dryers, furnaces, air conditioners, thermostats, televisions, light fixtures, vacuum cleaners, sprinklers, electricity meters, gas meters, etc., so long as the devices are equipped with an addressable communications interface for communicating with the IoT network. IoT devices may also include cell phones, desktop computers, laptop computers, tablet computers, personal digital assistants (PDAs), etc. Accordingly, the IoT network may be comprised of a combination of “legacy” Internet-accessible devices (e.g., laptop or desktop computers, cell phones, etc.) in addition to devices that do not typically have Internet-connectivity (e.g., dishwashers, etc.).

1020 1006 1005 In some embodiments, the user device(s), the mobile AP, and/or the APmay also include mesh stations in, for example, a mesh network, in accordance with one or more IEEE 802.11 standards and/or 3GPP standards.

1020 1024, 1026, 1028 1006 1005 1030 1035 1020 1005 1030 1035 1030 1035 1030 1035 Any of the user device(s)(e.g., user devices), the mobile AP, and the APmay be configured to communicate with each other via one or more communications networksand/orwirelessly or wired. The user device(s)may also communicate peer-to-peer or directly with each other with or without the AP. Any of the communications networksand/ormay include, but not limited to, any one of a combination of different types of suitable communications networks such as, for example, broadcasting networks, cable networks, public networks (e.g., the Internet), private networks, wireless networks, cellular networks, or any other suitable private and/or public networks. Further, any of the communications networksand/ormay have any suitable communication range associated therewith and may include, for example, global networks (e.g., the Internet), metropolitan area networks (MANs), wide area networks (WANs), local area networks (LANs), or personal area networks (PANs). In addition, any of the communications networksand/ormay include any type of medium over which network traffic may be carried including, but not limited to, coaxial cable, twisted-pair wire, optical fiber, a hybrid fiber coaxial (HFC) medium, microwave terrestrial transceivers, radio frequency communication mediums, white space communication mediums, ultra-high frequency communication mediums, satellite communication mediums, or any combination thereof.

1020 1024, 1026, 1028 1006 1005 1020 1024, 1026 1028 1006 1005 1020 1006 1005 Any of the user device(s)(e.g., user devices), the mobile AP, and the APmay include one or more communications antennas. The one or more communications antennas may be any suitable type of antennas corresponding to the communications protocols used by the user device(s)(e.g., user devicesand), the mobile AP, and the AP. Some non-limiting examples of suitable communications antennas include Wi-Fi antennas, Institute of Electrical and Electronics Engineers (IEEE) 802.11 family of standards compatible antennas, directional antennas, non-directional antennas, dipole antennas, folded dipole antennas, patch antennas, multiple-input multiple-output (MIMO) antennas, omnidirectional antennas, quasi-omnidirectional antennas, or the like. The one or more communications antennas may be communicatively coupled to a radio component to transmit and/or receive signals, such as communications signals to and/or from the user devices, the mobile AP, and/or the AP.

1020 1024, 1026, 1028 1006 1005 1020 1024, 1026 1028 1006 1005 1020 1024, 1026, 1028 1006 1005 1020 1024, 1026, 1028 1006 1005 Any of the user device(s)(e.g., user devices), the mobile AP, and the APmay be configured to perform directional transmission and/or directional reception in conjunction with wirelessly communicating in a wireless network. Any of the user device(s)(e.g., user devices,), the mobile AP, and the APmay be configured to perform such directional transmission and/or reception using a set of multiple antenna arrays (e.g., DMG antenna arrays or the like). Each of the multiple antenna arrays may be used for transmission and/or reception in a particular respective direction or range of directions. Any of the user device(s)(e.g., user devices), the mobile AP, and the APmay be configured to perform any given directional transmission towards one or more defined transmit sectors. Any of the user device(s)(e.g., user devices), the mobile AP, and the APmay be configured to perform any given directional reception from one or more defined receive sectors.

1020 1006 1005 MIMO beamforming in a wireless network may be accomplished using RF beamforming and/or digital beamforming. In some embodiments, in performing a given MIMO transmission, the user devices, the mobile AP, and/or the APmay be configured to use all or a subset of its one or more communications antennas to perform MIMO beamforming.

1020 1024, 1026, 1028 1006 1005 1020 1006 1005 2.4 5 6 Any of the user devices(e.g., user devices), the mobile AP, and the APmay include any suitable radio and/or transceiver for transmitting and/or receiving radio frequency (RF) signals in the bandwidth and/or channels corresponding to the communications protocols utilized by any of the user device(s), the mobile AP, and the APto communicate with each other. The radio components may include hardware and/or software to modulate and/or demodulate communications signals according to pre-established transmission protocols. The radio components may further have hardware and/or software instructions to communicate via one or more Wi-Fi and/or Wi-Fi direct protocols, as standardized by the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standards. In certain example embodiments, the radio component, in cooperation with the communications antennas, may be configured to communicate viaGHz channels (e.g. 802.11b, 802.11g, 802.11n, 802.11ax, 802.11be),GHz channels (e.g. 802.11n, 802.11ac, 802.11ax, 802.11be),GHz (e.g., 802.11be), or 60 GHZ channels (e.g. 802.11ad, 802.11ay) or 800 MHz channels (e.g. 802.11ah). The communications antennas may operate at 28 GHz and 40 GHz. It should be understood that this list of communication channels in accordance with certain 802.11 standards is only a partial list and that other 802.11 standards may be used (e.g., IEEE 802.11bi, Next Generation Wi-Fi, or other standards that may not be published or may be published as a draft standard). In some embodiments, non-Wi-Fi protocols may be used for communications between devices, such as Bluetooth, dedicated short-range communication (DSRC), Ultra-High Frequency (UHF) (e.g. IEEE 802.11af, IEEE 802.22), white band frequency (e.g., white spaces), or other packetized radio communications. The radio component may include any known receiver and baseband suitable for communicating via the communications protocols. The radio component may further include a low noise amplifier (LNA), additional signal amplifiers, an analog-to-digital (A/D) converter, one or more buffers, and digital baseband.

1 FIG.A 1006 1020 1020 1006 1020 1006 In one embodiment, and with reference to, encryption logic circuitry of the mobile APmay associate with each of the user devicesvia, e.g., a four-way handshake to form, e.g., a robust security network association (RSNA). Encryption logic circuitry of each of the user devicesmay receive a beacon frame or a probe response frame from the mobile APthat includes a BSS identifier (BSSID) and/or service set identifier (SSID), a capability bit that indicates that encryption is supported or enabled, and a cipher suite for use together with a set of one or more keys for encryption of group addressed management frames. The encryption logic circuitry of each of the user devicesmay individually respond to the mobile APwith an association request frame comprising a capability bit. The capability bit may indicate that encryption is supported or enabled and, in some embodiments, may reside in a robust security network (RSN) extended element (RSNXE) or an 802.11bi capabilities element.

1006 1020 In response to the association request, the encryption logic circuitry of the mobile APmay initiate a four-way handshake to establish keys for encryption of the group addressed management frames and possibly other keys for other RSN protection mechanisms. The four-way handshake may first establish a transient key for each of the user devicesthat can protect subsequent frame transmissions.

1006 1042 1020 1020 1006 1020 1006 1006 1020 1020 After the four-way handshake, the encryption logic circuitry of the mobile APmay transmit a management framesuch as a EAPOL-key message to each of the user devices. The management frame may comprise a key descriptor element (KDE) for a key such as a management frame group temporal key (MFGTK), a multi-link operation (MLO) MFGTK, a group temporal key (GTK), a MLO GTK, or the like. The KDEs may comprise key data for the MFGTK, MLO-MFGTK, GTK, and/or MLO-GTK transmitted to the user devices. In some embodiments, the encryption logic circuitry of the mobile APmay communicate a MFGTK or an MLO MFGTK to each of the user devices. In other embodiments, wherein the encryption logic circuitry of the mobile APestablishes more than one basic service set (BSS), the encryption logic circuitry of the mobile APmay assign MFGTKs and/or MLO-MFGTKs to some of the user devicesthat are associated with a first BSS and GTKs and/or MLO-GTKs to other of the user devicesthat are associated with a second BSS.

1020 1020 1006 1006 1020 For each key sent to the user devices, the encryption logic circuitry of the user devicesmay establish a replay counter, which involves implementation of a new definition for a replay counter for the MFGTKs and MLO-MFGTKs. The encryption logic circuitry of the mobile APmay cause the APto send the initial value for the replay counters to the respective user devices.

1020 1006 1043 1020 1043 1006 1020 1020 Once the user devicesreceive and install their respective keys and initialize the replay counters, the encryption logic circuitry of the mobile APmay cause transmission of the encrypted group addressed management framesto one or more user devicesto advantageously protect the personally identifiable information (PII) communicated in the encrypted group addressed management frames. The encryption logic circuitry of the mobile APmay increment the replay count (or value) for each encrypted group addressed management frame transmission, cause transmission of the replay count to the respective user devices, and, in some embodiments, the encryption logic circuitry of the user devicesmay respond with acknowledgement (ACK) frames that include the respective replay counts.

1006 1020 1006 Encryption of the group addressed management frames may involve layer 2 encryption or encryption of the data in the data field or payload of a medium access control (MAC) protocol data unit (MPDU) or the data in each of the data fields or payloads of an aggregate-MPDU (A-MPDU). For instance, the encryption logic circuitry of the mobile APmay generate, encrypt, and transmit a group addressed management frame that is addressed with a group address or broadcast address for two or more user devicesvia orthogonal frequency division multiple access (OFDMA) communications and/or via orthogonal frequency division multiplexing (OFDM). The group addressed management frame may comprise a current replay count for the key used to encrypt the group addressed management frame and the encryption logic circuitry of the mobile APmay increment the current replay count for the key.

1020 1020 1020 1020 The encryption logic circuitry of the two or more user devicesmay receive the encrypted group addressed management frame, decrypt the encrypted group addressed management frame with the installed key for group addressed management frames (MFGTK, MLO-MFGTK, GTK, or MLO-GTK), and decode the group addressed management frame. To verify that group addressed frame is not part of a replay attack, the encryption logic circuitry of the user devicesmay compare the current replay count for the key with previously received replay count values received by the user devicesto verify that the current replay count is the value expected or, at least, are not the same as the previously received replay counts. In some embodiments, the decryption processing prevents replay of MPDUs by validating that the PN in the PN field of the MPDU is greater than the replay counter maintained for the session. Based on receipt of the group addressed management frame with a verified replay count, the encryption logic circuitry of each of the user devicesmay determine to respond with, e.g., an acknowledgement (ACK) frame. In some embodiments, each ACK frame may include the corresponding replay count received in the group addressed management frame.

1020 1020 1020 1020 1006 1006 1006 Note that each of the user devicesthat are associated with the same BSS may have the same key for group addressed management frames, e.g., MFGTK and/or MLO-MFGTK so, a single replay counter may be defined by each of the user devicesfor the key associated with the BSS. For the group addressed management frame transmitted to user deviceswithin the same BSS, the encryption logic circuitry of each of the user devicesassociated with the BSS may receive the same current replay count, compare the same current replay count with one or more of the previously received replay counts in the replay counter, and respond with an ACK frame that comprises the same current replay count. The mobile APmay have two or more different current replay counts when group addressed management frames are transmitted in two or more different BSSs and are encrypted with two or more different keys. The encryption logic circuitry of the user devicesmay transmit and the encryption logic circuitry of the mobile APmay receive ACK frames for the two or more different BSSs. Each ACK frame may comprise a current replay count that corresponds to the key associated with the BSS of the ACK frame.

1 FIG.B 1 FIG.B 1 FIG.A 1120 1006 2.4 5 6 1 1130 1120 1 1 2 3 1 2 3 1130 illustrates an association process for MLO devices (MLDs). In, the AP MLDsuch as the mobile APdiscussed in, has three affiliated APs: AP 1 operates onGHz band, AP 2 operates onGHz band, and AP 3 operates onGHz band. The non-AP STAaffiliated with the non-AP MLDsends an association request frame (or a reassociation request frame) to AP 1 affiliated with the AP MLD. The association request frame may comprise a capability bit indicating support for RSNA, a TA field set to the MAC address of the non-AP STAand an RA field set to the MAC address of the AP 1. The association request frame may include complete information of non-AP STA, non-AP STA, and non-AP STAto request three links to be setup (one link between AP 1 and non-AP STA, one link between AP 2 and non-AP STA, and one link between AP 3 and non-AP STA) and a multi-link (ML) element that indicates the MLD MAC address of the non-AP MLD.

1 1 1130 1 1130 1 1140 1120 1130 1120 1 2 3 The encryption logic circuitry of the AP 1 may perform a four-way handshake with the non-AP STA, exchange one or more keys with non-AP STAfor each of the link IDs associated with the non-AP MLDin a KDE, initialize a replay count for each key, and send an association response frame to non-AP STAaffiliated with the non-AP MLDwith a TA field of the association response frame set to the MAC address of the AP 1 and an RA field of the association response frame set to the MAC address of the non-AP STA, to indicate successful multi-link setup. The association response frame may include complete information of AP 1, AP 2, and AP 3 and an ML element that indicates the MLD MAC address of the AP MLD. After successful ML setup between the non-AP MLDand the AP MLD, three links are setup (LINK 1 between AP 1 and non-AP STA, LINK 2 between AP 2 and non-AP STA, and LINK 3 between AP 3 and non-AP STA) and the keys (MLO-MFGTK or MLO-GTK) may be installed.

1130 1120 1130 1130 1130 1120 In some embodiments, the non-AP MLDmay associate with less than all the links available from the AP MLDfor various reasons. For instance, in some embodiments, the non-AP MLDmay only be capable of establishing two of the links. In some embodiments, the non-AP MLDmay establish a link with a second AP MLD because the second AP MLD may have a better signal-to-noise ratio associated with one or more links and be associated with the same ESS. In some embodiments, the non-AP MLDmay establish a link with a second AP MLD because the second AP MLD may be associated with a different ESS or a BSS that is not associated with the BSS of the AP MLD.

1 FIG.C 1200 1210 1230 1290 1292 1294 1296 1298 1210 1210 1230 1290 1292 1294 1296 1298 depicts an embodiment of a systemto transmit or receive as well as to generate, transmit, receive, decode, and interpret transmissions between an AP stationand multiple STAs,,,,, and, associated with the AP station. The AP STAmay be wired and wirelessly connected to each of the STAs,,,,, and.

1210 1230 5 6 7 8 FIGS.,,, and In some embodiments, the STAsandmay include one or more computer systems similar to that of the example machines/systems of.

1230 1290 1292 1294 1296 1298 1250 1230 1210 1210 1210 1210 1230 1290 1292 1294 1296 1298 1230 1290 1292 1294 1296 1298 1210 The encryption logic circuitry of each STA,,,,, and(such as the encryption logic circuitryof STA) may associate with the AP STAvia at least one link associated with at least one BSS of the AP STAand receive and install a key such as an MLO-MFGTK associated with the at least one BSS. After associating with the AP STA, the AP STAmay buffer data to downlink (DL) to the STAs,,,,, andand each STA,,,,, andmay collect data to uplink (UL) to the AP STA.

1220 1210 1230 1290 1292 1294 1296 1298 1220 1210 1230 1290 1292 1294 1296 1298 Periodically, the encryption logic circuitryof the AP STAmay cause transmission of an encrypted group addressed management frame to the STAs,,,,, andwith a group address or broadcast address as a target address (TA). The encryption logic circuitryof the AP STAmay encrypt the data or payload portion of the MPDU of the group addressed management frame with the key associated with the at least one BSS. The group addressed management frame may comprise a traffic indication map (TIM) element with a bitmap in a partial virtual bitmap field to schedule a protected TxOP to DL buffered data to the STAs,,,,, andsimultaneously.

1210 1230 1290 1292 1294 1296 1298 1230 1290 1292 1294 1296 1298 1230 1290 1292 1294 1296 1298 1230, 1290 1292 1294 1296 1298 In response to receipt of the encrypted group addressed management frame from the AP STA, the encryption logic circuitry of one or more of STAs,,,,, andmay decrypt and decode the encrypted group addressed management frame with the corresponding key for the BSS. The encryption logic circuitry of the one or more of STAs,,,,, andmay also verify the replay count included in the encrypted group addressed management frame prior to determining whether or how to respond. Upon verification of the replay count, the one or more of STAs,,,,, andmay determine to respond with, e.g., a MAC ACK to indicate that the STAs,,,, andare ready to receive the DL buffered data.

1230 In some circumstances, a non-AP STA such as the non-AP STA, may initiate a fast BSS transition or reassociation to transition between a first BSS in an extended service set (ESS) to a second BSS in the ESS. A fast BSS transition is a BSS transition that establishes the state necessary for data connectivity before the reassociation rather than after the reassociation. In many embodiments, only the fast BSS transition facility can move an RSNA during reassociation. Therefore, if FT is not used, the old RSNA is deleted and a new RSNA is constructed.

The FT mechanism defines a means for a STA to set up security and quality of service (QoS) parameters prior to reassociation to a new AP. This mechanism advantageously allows time-consuming operations to be removed from the time-critical reassociation process. During a handover across mobility domains, the overhead incurred during the FT initial mobility domain association in an RSN can be reduced using FILS authentication.

1230 1210 1210 1230 For instance, the encryption logic circuitry of the non-AP STAmay transmit a FT request frame to the AP STAto initiate a FT to another AP in a second BSS of the extended service set (ESS). The encryption logic circuitry of the AP STAmay transmit a FT response frame comprising a new key or updated key such as a MFGTK to the non-AP STAduring the FT in a MFGTK subelement or a MLO MFGTK subelement of a fast BSS transition element (FTE) in a FT response frame body of the FT response frame.

1230 1210 1210 1230 In some embodiments, the non-AP STAmay periodically transmit a WNM sleep mode request frame to the AP STAto enter the WNM sleep mode. The encryption logic circuitry of the AP STAmay transmit a new key or updated key such as a MFGTK to the non-AP STAin a WNM sleep mode response frame in a MFGTK subelement or a MLO MFGTK subelement.

1210 1210 1230 1210 1230 The WNM sleep mode response frame may be sent by the AP STAin response to a WNM sleep mode request frame or may be sent without solicitation by the AP STAto the non-AP STAupon the AP’s deletion of all traffic filter sets established according to the traffic filtering agreement between the AP STAand the non-AP STA.

1210 1201 1211 1201 1211 1211 1211 1212 The AP STAmay comprise processor(s)and memory. The processor(s)may comprise any data processing device such as a microprocessor, a microcontroller, a state machine, and/or the like, and may execute instructions or code in the memory. The memorymay comprise a storage medium such as Dynamic Random Access Memory (DRAM), read only memory (ROM), buffers, registers, cache, flash memory, hard disk drives, solid-state drives, or the like. The memorymay storethe frames, frame structures, frame headers, etc., and may also comprise code to generate, scramble, encode, decode, parse, and interpret MAC frames and/or physical layer (PHY) frames and PHY protocol data units (PPDUs).

1218 1220 1210 1218 1201 The baseband processing circuitrymay comprise a baseband processor and/or one or more circuits to implement a station management entity (SME). In some embodiments, the SME may interact with a MAC layer management entity to perform MAC layer functionality and a PHY management entity to perform PHY functionality. The station management entity may comprise at least part of the encryption logic circuitry such as the encryption logic circuitryof STA. In such embodiments, the baseband processing circuitrymay interact with processor(s)to coordinate higher layer functionality with MAC layer and PHY functionality.

1218 1218 In some embodiments, the baseband processing circuitrymay interact with one or more analog devices to perform PHY functionality such as scrambling, encoding, modulating, and the like. In other embodiments, the baseband processing circuitrymay execute code to perform one or more of the PHY functionality such as scrambling, encoding, modulating, and the like.

1211 1201 The MAC layer functionality may execute MAC layer code stored in the memorysuch as encryption logic circuity code. In further embodiments, the MAC layer functionality may interface the processor(s).

1230 1220 1220 1205 1210 The MAC layer functionality may communicate with the PHY to transmit a MAC frame such as a group addressed management frame in a PHY frame such as an EHT MU PPDU to the station. The MAC layer functionality may generate frames such as management, data, and control frames and the encryption logic circuitryof the MAC layer may encrypt the data field or payload of the group addressed management frames with a key such as a MFGTK, a MLO-MFGTK, a GTK, or a MLO-GTK. In some embodiments, the encryption logic circuitryof the MAC layer may not encrypt a data field or payload that includes a timestamp field with a timestamp value from a TSF timerof the STA, which is indicative of the time of transmission of the group addressed management frame.

1222 1218 1224 1205 1210 1210 The PHY may prepare the MAC frame for transmission by, e.g., determining a preamble to prepend to a MAC frame to create a PHY frame. The preamble may include one or more short training field (STF) values, long training field (LTF) values, and signal (SIG) field values. A wireless network interfaceor the baseband processing circuitrymay prepare the PHY frame as a scrambled, encoded, modulated PPDU in the time domain signals for the radio. Furthermore, the TSF timermay provide a timestamp value in a timestamp field of the STAto indicate the time at which the PPDU is transmitted in some PPDUs. Note that if the timestamp value is not included in the frame body of a group addressed management frame, the encryption logic circuitry of the AP STAmay encrypt the group addressed management frame.

1225 1224 1280 1230 After processing the PHY frame, a radiomay impress digital data onto subcarriers of RF frequencies for transmission by electromagnetic radiation via elements of an antenna array or antennasand via the networkto a receiving STA such as the STA.

1222 1218 The wireless network I/Falso comprises a receiver. The receiver receives electromagnetic energy, extracts the digital data, and the analog PHY and/or the baseband processordecodes a PHY frame and a MAC frame from a PPDU.

1230 1210 1280 1230 1231 1241 1231 1241 1241 1241 1242 The STAmay receive the MU-RTS in the EHT MU PPDU from the STAvia the networkas an encrypted group addressed management frame. The STAmay comprise processor(s)and memory. The processor(s)may comprise any data processing device such as a microprocessor, a microcontroller, a state machine, and/or the like, and may execute instructions or code in the memory. The memorymay comprise a storage medium such as Dynamic Random Access Memory (DRAM), read only memory (ROM), buffers, registers, cache, flash memory, hard disk drives, solid-state drives, or the like. The memorymay storethe frames, frame structures, frame headers, etc., and may also comprise code to generate, scramble, encode, encrypt, decrypt, decode, parse, and interpret MAC frames and/or PHY frames (PPDUs) such as group addressed management frames.

1248 1248 1231 1250 1230 The baseband processing circuitrymay comprise a baseband processor and/or one or more circuits to implement a station management entity (SME) and the SME may interact with a MAC layer management entity to perform MAC layer functionality and a PHY management entity to perform PHY functionality. In such embodiments, the baseband processing circuitrymay interact with processor(s)to coordinate higher layer functionality with MAC layer and PHY functionality. In some embodiments, the MAC layer management entity may comprise at least part of the encryption logic circuitryof the STA. MLDs may also include a multiple medium access control (MAC) station management entity (SME) (MM-SME) to manage multiple STAs within the MLD and may coordinate functionality of the SMEs for each of the STAs of the MLD to perform MLO functionality.

1218 1218 In some embodiments, the baseband processing circuitrymay interact with one or more analog devices to perform PHY functionality such as descrambling, decoding, demodulating, and the like. In other embodiments, the baseband processing circuitrymay execute code to perform one or more of the PHY functionalities such as descrambling, decoding, demodulating, and the like.

1230 1258 1256 1256 1254 1254 1252 1248 1248 The STAmay receive the EHT MU PPDU at the antennas, which pass the signals along to the FEM. The FEMmay amplify and filter the signals and pass the signals to the radio. The radiomay filter the carrier signals from the signals and determine if the signals represent a PPDU. If so, analog circuitry of the wireless network I/For physical layer functionality implemented in the baseband processing circuitrymay demodulate, decode, descramble, etc. the PPDU. The baseband processing circuitrymay identify, parse, and interpret the MAC MU-RTS from the PSDU of the EHT MU PPDU.

1230 1250 1220 1218 1210 1220 1230 The STAfurther comprises an encryption logic circuitrythat may, in some embodiments, operate in conjunction with the encryption logic circuitryin the baseband processing circuitryof the AP STA. For instance, upon reception of the EHT MU PPDU, the encryption logic circuitrymay decrypt the frame body of the EHT MU PPDU received by the non-AP STAwith a MLO-MFGTK, MFGTK, MLO-GTK, or GTK used together with the cipher suite provided for encryption of group addressed management frames.

1 FIG.D 1 FIG.A 1216 1246 1005 1006 1020 1216 1246 1304 1306 1308 1224 1254 a-b a-b a-b is a block diagram of a radio architecture such as the wireless communications I/Fandin accordance with some embodiments that may be implemented in any one of the example AP, mobile AP, and/or the example user devicesof. Radio architectureandmay include radio front-end module (FEM) circuitry, radio IC circuitryand baseband processing circuitry. Radio architectureandas shown includes both Wireless Local Area Network (WLAN) functionality and Bluetooth (BT) functionality although embodiments are not so limited. In this disclosure, “WLAN” and “Wi-Fi” are used interchangeably.

1304 1304 1304 1304 1301 1306 1304 1301 1306 1304 1306 1301 1304 1306 1304 1304 a b a a b a a b b a b 1 FIG.D FEM circuitrya-b may include a WLAN or Wi-Fi FEM circuitryand a Bluetooth (BT) FEM circuitry. The WLAN FEM circuitrymay include a receive signal path comprising circuitry configured to operate on WLAN RF signals received from one or more antennas, to amplify the received signals and to provide the amplified versions of the received signals to the WLAN radio IC circuitryfor further processing. The BT FEM circuitryb may include a receive signal path which may include circuitry configured to operate on BT RF signals received from one or more antennas, to amplify the received signals and to provide the amplified versions of the received signals to the BT radio IC circuitryfor further processing. FEM circuitrymay also include a transmit signal path which may include circuitry configured to amplify WLAN signals provided by the radio IC circuitryfor wireless transmission by one or more of the antennas. In addition, FEM circuitrymay also include a transmit signal path which may include circuitry configured to amplify BT signals provided by the radio IC circuitryfor wireless transmission by the one or more antennas. In the embodiment of, although FEMand FEMare shown as being distinct from one another, embodiments are not so limited, and include within their scope the use of an FEM (not shown) that includes a transmit path and/or a receive path for both WLAN and BT signals, or the use of one or more FEM circuitries where at least some of the FEM circuitries share transmit and/or receive signal paths for both WLAN and BT signals.

1306 1306 1306 1306 1304 1308 1306 1304 1308 1306 1308 1304 1301 1306 1308 1304 1301 1306 1306 a-b a b a a a b b b a a a b b b a b 1 FIG.D Radio IC circuitryas shown may include WLAN radio IC circuitryand BT radio IC circuitry. The WLAN radio IC circuitrymay include a receive signal path which may include circuitry to down-convert WLAN RF signals received from the FEM circuitryand provide baseband signals to WLAN baseband processing circuitry. BT radio IC circuitrymay in turn include a receive signal path which may include circuitry to down-convert BT RF signals received from the FEM circuitryand provide baseband signals to BT baseband processing circuitry. WLAN radio IC circuitrymay also include a transmit signal path which may include circuitry to up-convert WLAN baseband signals provided by the WLAN baseband processing circuitryand provide WLAN RF output signals to the FEM circuitryfor subsequent wireless transmission by the one or more antennas. BT radio IC circuitrymay also include a transmit signal path which may include circuitry to up-convert BT baseband signals provided by the BT baseband processing circuitryand provide BT RF output signals to the FEM circuitryfor subsequent wireless transmission by the one or more antennas. In the embodiment of, although radio IC circuitriesandare shown as being distinct from one another, embodiments are not so limited, and include within their scope the use of a radio IC circuitry (not shown) that includes a transmit signal path and/or a receive signal path for both WLAN and BT signals, or the use of one or more radio IC circuitries where at least some of the radio IC circuitries share transmit and/or receive signal paths for both WLAN and BT signals.

1308 1218 1248 1308 1308 1308 1308 1308 1308 1306 1306 1308 1308 1306 a-b a b a a a b a-b a-b a b a-b 1 FIG.C Baseband processing circuity, such as the baseband processing circuitryandshown in, may include a WLAN baseband processing circuitryand a BT baseband processing circuitry. The WLAN baseband processing circuitrymay include a memory, such as, for example, a set of RAM arrays in a Fast Fourier Transform or Inverse Fast Fourier Transform block (not shown) of the WLAN baseband processing circuitry. Each of the WLAN baseband circuitryand the BT baseband circuitrymay further include one or more processors and control logic to process the signals received from the corresponding WLAN or BT receive signal path of the radio IC circuitry, and to also generate corresponding WLAN or BT baseband signals for the transmit signal path of the radio IC circuitry. Each of the baseband processing circuitriesandmay further include physical layer (PHY) and medium access control layer (MAC) circuitry, and may further interface with a device for generation and processing of the baseband signals and for controlling operations of the radio IC circuitry.

1 FIG.D 1313 1308 1308 1303 1304 1304 1301 1304 1304 1304 1304 a b a b a b a b Referring still to, according to the shown embodiment, WLAN-BT coexistence circuitrymay include logic providing an interface between the WLAN baseband circuitryand the BT baseband circuitryto enable use cases requiring WLAN and BT coexistence. In addition, a switch circuitrymay be provided between the WLAN FEM circuitryand the BT FEM circuitryto allow switching between the WLAN and BT radios according to application needs. In addition, although the antennasare depicted as being respectively connected to the WLAN FEM circuitryand the BT FEM circuitry, embodiments include within their scope the sharing of one or more antennas as between the WLAN and BT FEMs, or the provision of more than one antenna connected to each of FEMor.

1304 1306 1308 1302 1301 1304 1306 1306 1308 1312 a-b a-b a-b a-b a-b a-b a-b In some embodiments, the front-end module circuitry, the radio IC circuitry, and baseband processing circuitrymay be provided on a single radio card, such as wireless network interface card (NIC). In some other embodiments, the one or more antennas, the FEM circuitryand the radio IC circuitrymay be provided on a single radio card. In some other embodiments, the radio IC circuitryand the baseband processing circuitrymay be provided on a single chip or integrated circuit (IC), such as IC.

1302 1216 1246 In some embodiments, the wireless NICmay include a WLAN radio card and may be configured for Wi-Fi communications, although the scope of the embodiments is not limited in this respect. In some of these embodiments, the radio architectureandmay be configured to receive and transmit orthogonal frequency division multiplexed (OFDM) or orthogonal frequency division multiple access (OFDMA) communication signals over a multicarrier communication channel. The OFDM or OFDMA signals may comprise a plurality of orthogonal subcarriers.

1216 1246 1216 1246 1216 1246 In some of these multicarrier embodiments, radio architectureandmay be part of a Wi-Fi communication station (STA) such as a wireless access point (AP), a base station or a mobile device including a Wi-Fi device. In some of these embodiments, radio architectureandmay be configured to transmit and receive signals in accordance with specific communication standards and/or protocols, such as any of the Institute of Electrical and Electronics Engineers (IEEE) standards including, 802.11n-2009, IEEE 802.11-2012, IEEE 802.11-2020, 802.11ay, 802.11ba, 802.11ax, 802.11bi, and/or 802.11be standards and/or proposed specifications for WLANs, although the scope of embodiments is not limited in this respect. Radio architectureandmay also be suitable to transmit and/or receive communications in accordance with other techniques and standards.

1216 1246 1216 1246 In some embodiments, the radio architectureandmay be configured for high-efficiency Wi-Fi (HEW) communications in accordance with the IEEE 802.11ax standard. In these embodiments, the radio architectureandmay be configured to communicate in accordance with an OFDMA technique, although the scope of the embodiments is not limited in this respect.

1216 1246 In some other embodiments, the radio architectureandmay be configured to transmit and receive signals transmitted using one or more other modulation techniques such as spread spectrum modulation (e.g., direct sequence code division multiple access (DS-CDMA) and/or frequency hopping code division multiple access (FH-CDMA)), time-division multiplexing (TDM) modulation, and/or frequency-division multiplexing (FDM) modulation, although the scope of the embodiments is not limited in this respect.

1 FIG.D 1308 b In some embodiments, as further shown in, the BT baseband circuitrymay be compliant with a Bluetooth (BT) connectivity standard such as Bluetooth, Bluetooth 8.0 or Bluetooth 6.0, or any other iteration of the Bluetooth Standard.

1216 1246 In some embodiments, the radio architectureandmay include other radio cards, such as a cellular radio card configured for cellular (e.g., 5GPP such as LTE, LTE-Advanced or 7G communications).

1216 1246 In some IEEE 802.11 embodiments, the radio architectureandmay be configured for communication over various channel bandwidths including bandwidths having center frequencies of about 2.4GHz, 5 GHz, and 6 GHz. The various bandwidths may include bandwidths of about 20 MHz, 40 MHz, 80 MHz, 160 MHz, 240 MHz, and 320 MHz with contiguous or non-contiguous bandwidths having increments of 20 MHz, 40 MHz, 80 MHz, 160 MHz, 240 MHz, and 320 MHz. The scope of the embodiments is not limited with respect to the above center frequencies however.

1 FIG.E 1 FIG.D 1 FIG.E 1 FIG.E 1400 1304 1304 1304 a a b illustrates a WLAN FEM circuitryas an example of the WLAN FEM circuitryshown inin accordance with some embodiments. Although the example ofis described in conjunction with the WLAN FEM circuitry, the example ofmay also describe other configurations such as BT FEM circuitry.

1400 1402 1400 1304 1406 1403 1407 1306 1400 1409 1306 1412 1415 1301 1414 a a-b a-b 1 FIG.D 1 FIG.D In some embodiments, the FEM circuitrymay include a TX/RX switchto switch between transmit mode and receive mode operation. The FEM circuitrymay include a receive signal path and a transmit signal path. The receive signal path of the FEM circuitrymay include a low-noise amplifier (LNA)to amplify received RF signalsand provide the amplified received RF signalsas an output (e.g., to the radio IC circuitry()). The transmit signal path of the circuitrymay include a power amplifier (PA) to amplify input RF signals(e.g., provided by the radio IC circuitry), and one or more filters, such as band-pass filters (BPFs), low-pass filters (LPFs) or other types of filters, to generate RF signalsfor subsequent transmission (e.g., by one or more of the antennas()) via an example duplexer.

1400 2.4 5 6 1400 1404 1406 1400 1410 1412 1404 1301 2.4 1400 1 FIG.D In some dual-mode embodiments for Wi-Fi communication, the FEM circuitrymay be configured to operate in theGHz frequency spectrum, theGHz frequency spectrum, or theGHz frequency spectrum. In these embodiments, the receive signal path of the FEM circuitrymay include a receive signal path duplexerto separate the signals from each spectrum as well as provide a separate LNAfor each spectrum as shown. In these embodiments, the transmit signal path of the FEM circuitrymay also include a power amplifierand a filter, such as a BPF, an LPF or another type of filter for each frequency spectrum and a transmit signal path duplexerto provide the signals of one of the different spectrums onto a single transmit path for subsequent transmission by the one or more of the antennas(). In some embodiments, BT communications may utilize theGHz signal paths and may utilize the same FEM circuitryas the one used for WLAN communications.

1 FIG.F 1 FIG.D 1 FIG.F 1506 1306 1506 1306 1306 1306 a a a a b b illustrates radio IC circuitryas an example of the radio IC circuitryin accordance with some embodiments. The radio IC circuitryis one example of circuitry that may be suitable for use as the WLAN or BT radio IC circuitry/(), although other circuitry configurations may also be suitable. Alternatively, the example ofmay be described in conjunction with the example BT radio IC circuitry.

1506 1506 1502 1506 1508 1506 1512 1514 1506 1504 1505 1502 1514 1502 1514 1514 1508 1512 a a a a 1 FIG.F In some embodiments, the radio IC circuitrymay include a receive signal path and a transmit signal path. The receive signal path of the radio IC circuitrymay include at least mixer circuitry, such as, for example, down-conversion mixer circuitry, amplifier circuitryand filter circuitry. The transmit signal path of the radio IC circuitrymay include at least filter circuitryand mixer circuitry, such as, for example, up-conversion mixer circuitry. Radio IC circuitrymay also include synthesizer circuitryfor synthesizing a frequencyfor use by the mixer circuitryand the mixer circuitry. The mixer circuitryand/ormay each, according to some embodiments, be configured to provide direct conversion functionality. The latter type of circuitry presents a much simpler architecture as compared with standard super-heterodyne mixer circuitries, and any flicker noise brought about by the same may be alleviated for example through the use of OFDM modulation.illustrates only a simplified version of a radio IC circuitry, and may include, although not shown, embodiments where each of the depicted circuitries may include more than one component. For instance, mixer circuitrymay each include one or more mixers, and filter circuitriesand/ormay each include one or more filters, such as one or more BPFs and/or LPFs according to application needs. For example, when mixer circuitries are of the direct-conversion type, they may each include two or more mixers.

1502 1407 1304 1505 1504 1506 1508 1507 1507 1308 1507 1502 a-b a-b 1 FIG.D 1 FIG.D In some embodiments, mixer circuitrymay be configured to down-convert RF signalsreceived from the FEM circuitry() based on the synthesized frequencyprovided by synthesizer circuitry. The amplifier circuitrymay be configured to amplify the down-converted signals and the filter circuitrymay include an LPF configured to remove unwanted signals from the down-converted signals to generate output baseband signals. Output baseband signalsmay be provided to the baseband processing circuitry() for further processing. In some embodiments, the output baseband signalsmay be zero-frequency baseband signals, although this is not a requirement. In some embodiments, mixer circuitrymay comprise passive mixers, although the scope of the embodiments is not limited in this respect.

1514 1511 1505 1504 1409 1304 1511 1308 1512 1512 a-b a-b In some embodiments, the mixer circuitrymay be configured to up-convert input baseband signalsbased on the synthesized frequencyprovided by the synthesizer circuitryto generate RF output signalsfor the FEM circuitry. The baseband signalsmay be provided by the baseband processing circuitryand may be filtered by filter circuitry. The filter circuitrymay include an LPF or a BPF, although the scope of the embodiments is not limited in this respect.

1502 1514 1504 1502 1514 1502 1514 1502 1514 In some embodiments, the mixer circuitryand the mixer circuitrymay each include two or more mixers and may be arranged for quadrature down-conversion and/or up-conversion respectively with the help of synthesizer. In some embodiments, the mixer circuitryand the mixer circuitrymay each include two or more mixers each configured for image rejection (e.g., Hartley image rejection). In some embodiments, the mixer circuitryand the mixer circuitrymay be arranged for direct down-conversion and/or direct up-conversion, respectively. In some embodiments, the mixer circuitryand the mixer circuitrymay be configured for super-heterodyne operation, although this is not a requirement.

1502 1407 1 FIG.F Mixer circuitrymay comprise, according to one embodiment: quadrature passive mixers (e.g., for the in-phase (I) and quadrature phase (Q) paths). In such an embodiment, RF input signalfrommay be down-converted to provide I and Q baseband output signals to be sent to the baseband processor.

1505 1504 1 FIG.F Quadrature passive mixers may be driven by zero and ninety-degree time-varying LO switching signals provided by a quadrature circuitry which may be configured to receive a LO frequency (fLO) from a local oscillator or a synthesizer, such as LO frequencyof synthesizer(). In some embodiments, the LO frequency may be the carrier frequency, while in other embodiments, the LO frequency may be a fraction of the carrier frequency (e.g., one-half the carrier frequency, one-third the carrier frequency). In some embodiments, the zero and ninety-degree time-varying switching signals may be generated by the synthesizer, although the scope of the embodiments is not limited in this respect.

In some embodiments, the LO signals may differ in duty cycle (the percentage of one period in which the LO signal is high) and/or offset (the difference between start points of the period). In some embodiments, the LO signals may have an 85% duty cycle and an 80% offset. In some embodiments, each branch of the mixer circuitry (e.g., the in-phase (I) and quadrature phase (Q) path) may operate at an 80% duty cycle, which may result in a significant reduction is power consumption.

1407 1506 1508 1 FIG.E 1 FIG.F 1 FIG.F The RF input signal() may comprise a balanced signal, although the scope of the embodiments is not limited in this respect. The I and Q baseband output signals may be provided to low-noise amplifier, such as amplifier circuitry() or to filter circuitry().

1507 1511 1507 1511 In some embodiments, the output baseband signalsand the input baseband signalsmay be analog baseband signals, although the scope of the embodiments is not limited in this respect. In some alternate embodiments, the output baseband signalsand the input baseband signalsmay be digital baseband signals. In these alternate embodiments, the radio IC circuitry may include analog-to-digital converter (ADC) and digital-to-analog converter (DAC) circuitry.

In some dual-mode embodiments, a separate radio IC circuitry may be provided for processing signals for each spectrum, or for other spectrums not mentioned here, although the scope of the embodiments is not limited in this respect.

1504 1504 1504 1504 1308 1505 1310 1310 101 103 a-b 1 FIG.D In some embodiments, the synthesizer circuitrymay be a fractional-N synthesizer or a fractional N/N+1 synthesizer, although the scope of the embodiments is not limited in this respect as other types of frequency synthesizers may be suitable. For example, synthesizer circuitrymay be a delta-sigma synthesizer, a frequency multiplier, or a synthesizer comprising a phase-locked loop with a frequency divider. According to some embodiments, the synthesizer circuitrymay include digital synthesizer circuitry. An advantage of using a digital synthesizer circuitry is that, although it may still include some analog components, its footprint may be scaled down much more than the footprint of an analog synthesizer circuitry. In some embodiments, frequency input into synthesizer circuitymay be provided by a voltage controlled oscillator (VCO), although that is not a requirement. A divider control input may further be provided by either the baseband processing circuitry() depending on the desired output frequency. In some embodiments, a divider control input (e.g., N) may be determined from a look-up table (e.g., within a Wi-Fi card) based on a channel number and a channel center frequency as determined or indicated by the example application processor. The application processormay include, or otherwise be connected to, one of the example secure signal converteror the example received signal converter(e.g., depending on which device the example radio architecture is implemented in).

1504 1505 1505 1505 In some embodiments, synthesizer circuitrymay be configured to generate a carrier frequency as the output frequency, while in other embodiments, the output frequencymay be a fraction of the carrier frequency (e.g., one-half the carrier frequency, one-third the carrier frequency). In some embodiments, the output frequencymay be a LO frequency (fLO).

1 FIG.G 1 FIG.D 1 FIG.F 1 FIG.D 1308 1308 1308 1308 a a a b illustrates a functional block diagram of baseband processing circuitryin accordance with some embodiments. The baseband processing circuitryis one example of circuitry that may be suitable for use as the baseband processing circuitry(), although other circuitry configurations may also be suitable. Alternatively, the example ofmay be used to implement the example BT baseband processing circuitryof.

1308 1602 1509 1306 1604 1511 1306 1308 1606 1308 a a-b a-b a a 1 FIG.D The baseband processing circuitrymay include a receive baseband processor (RX BBP)for processing receive baseband signalsprovided by the radio IC circuitry() and a transmit baseband processor (TX BBP)for generating transmit baseband signalsfor the radio IC circuitry. The baseband processing circuitrymay also include control logicfor coordinating the operations of the baseband processing circuitry.

1308 1306 1308 1610 1609 1306 1602 1308 1612 1604 1611 a-b a-b a a-b a In some embodiments (e.g., when analog baseband signals are exchanged between the baseband processing circuitryand the radio IC circuitry), the baseband processing circuitrymay include ADCto convert analog baseband signalsreceived from the radio IC circuitryto digital baseband signals for processing by the RX BBP. In these embodiments, the baseband processing circuitrymay also include DACto convert digital baseband signals from the TX BBPto analog baseband signals.

1308 1604 1602 1602 a In some embodiments that communicate OFDM signals or OFDMA signals, such as through baseband processor, the transmit baseband processormay be configured to generate OFDM or OFDMA signals as appropriate for transmission by performing an inverse fast Fourier transform (IFFT). The receive baseband processormay be configured to process received OFDM signals or OFDMA signals by performing an FFT. In some embodiments, the receive baseband processormay be configured to detect the presence of an OFDM signal or OFDMA signal by performing an autocorrelation, to detect a preamble, such as a short preamble, and by performing a cross-correlation, to detect a long preamble. The preambles may be part of a predetermined frame structure for Wi-Fi communication.

1 FIG.D 1 FIG.D 1301 1301 Referring back to, in some embodiments, the antennas() may each comprise one or more directional or omnidirectional antennas, including, for example, dipole antennas, monopole antennas, patch antennas, loop antennas, microstrip antennas or other types of antennas suitable for transmission of RF signals. In some multiple-input multiple-output (MIMO) embodiments, the antennas may be effectively separated to take advantage of spatial diversity and the different channel characteristics that may result. Antennasmay each include a set of phased-array antennas, although embodiments are not so limited.

1216 1246 Although the radio architectureandis illustrated as having several separate functional elements, one or more of the functional elements may be combined and may be implemented by combinations of software-configured elements, such as processing elements including digital signal processors (DSPs), and/or other hardware elements. For example, some elements may comprise one or more microprocessors, DSPs, field-programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), radio-frequency integrated circuits (RFICs) and combinations of various hardware and logic circuitry for performing at least the functions described herein. In some embodiments, the functional elements may refer to one or more processes operating on one or more processing elements.

The word “exemplary” is used herein to mean “serving as an example, instance, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments. The terms “computing device,” “user device,” “communication station,” “station,” “handheld device,” “mobile device,” “wireless device” and “user equipment” (UE) as used herein refers to a wireless communication device such as a cellular telephone, a smartphone, a tablet, a netbook, a wireless terminal, a laptop computer, a femtocell, a high data rate (HDR) subscriber station, an access point, a printer, a point of sale device, an access terminal, or other personal communication system (PCS) device. The device may be either mobile or stationary.

As used within this document, the term “communicate” is intended to include transmitting, or receiving, or both transmitting and receiving. This may be particularly useful in claims when describing the organization of data that is being transmitted by one device and received by another, but only the functionality of one of those devices is required to infringe the claim. Similarly, the bidirectional exchange of data between two devices (both devices transmit and receive during the exchange) may be described as “communicating,” when only the functionality of one of those devices is being claimed. The term “communicating” as used herein with respect to a wireless communication signal includes transmitting the wireless communication signal and/or receiving the wireless communication signal. For example, a wireless communication unit, which is capable of communicating a wireless communication signal, may include a wireless transmitter to transmit the wireless communication signal to at least one other wireless communication unit, and/or a wireless communication receiver to receive the wireless communication signal from at least one other wireless communication unit.

As used herein, unless otherwise specified, the use of the ordinal adjectives “first,” “second,” “third,” etc., to describe a common object, merely indicates that different instances of like objects are being referred to and are not intended to imply that the objects so described must be in a given sequence, either temporally, spatially, in ranking, or in any other manner.

The term “access point” (AP) as used herein may be a fixed station. An access point may also be referred to as an access node, a base station, an evolved node B (eNodeB), or some other similar terminology known in the art. An access terminal may also be called a mobile station, user equipment (UE), a wireless communication device, or some other similar terminology known in the art. Embodiments disclosed herein generally pertain to wireless networks. Some embodiments may relate to wireless networks that operate in accordance with one of the IEEE 802.11 standards.

Some embodiments may be used in conjunction with one way and/or two-way radio communication systems, cellular radio-telephone communication systems, a mobile phone, a cellular telephone, a wireless telephone, a personal communication system (PCS) device, a PDA device which incorporates a wireless communication device, a mobile or portable global positioning system (GPS) device, a device which incorporates a GPS receiver or transceiver or chip, a device which incorporates an RFID element or chip, a multiple input multiple output (MIMO) transceiver or device, a single input multiple output (SIMO) transceiver or device, a multiple input single output (MISO) transceiver or device, a device having one or more internal antennas and/or external antennas, digital video broadcast (DVB) devices or systems, multi-standard radio devices or systems, a wired or wireless handheld device, e.g., a smartphone, a wireless application protocol (WAP) device, or the like.

Some embodiments may be used in conjunction with one or more types of wireless communication signals and/or systems following one or more wireless communication protocols, for example, radio frequency (RF), infrared (IR), frequency-division multiplexing (FDM), orthogonal FDM (OFDM), time-division multiplexing (TDM), time-division multiple access (TDMA), extended TDMA (E-TDMA), general packet radio service (GPRS), extended GPRS, code-division multiple access (CDMA), wideband CDMA (WCDMA), CDMA 2000, single-carrier CDMA, multi-carrier CDMA, multi-carrier modulation (MDM), discrete multi-tone (DMT), Bluetooth®, global positioning system (GPS), Wi-Fi, Wi-Max, ZigBee, ultra-wideband (UWB), global system for mobile communications (GSM), 2G, 2.5G, 3G, 3.5G, 4G, fifth generation (5G) mobile networks, 3GPP, long term evolution (LTE), LTE advanced, enhanced data rates for GSM Evolution (EDGE), or the like. Other embodiments may be used in various other devices, systems, and/or networks.

2 2 FIGS.A-C 2 FIG.A 2010 illustrate embodiments of channels and subchannels (or resource units) that can facilitate multiple transmissions simultaneously along with transmission of a WUR PPDU.illustrates an embodiment of transmissionsbetween four stations and an AP on four different subchannels (or resource units) of a channel via OFDMA. Grouping subcarriers into groups of resource units is referred to as subchannelization. Subchannelization defines subchannels that can be allocated to stations depending on their channel conditions and service requirements. An OFDMA system may also allocate different transmit powers to different subchannels.

1 2 3 4 2010 20 20 4 2015 2015 2 FIG.B 2 FIG.A In the present embodiment, the OFDMA STA, OFDMA STA, OFDMA STA, and OFDMA STAmay represent transmissions on a four different subchannels of the channel. For instance, transmissionsmay represent an 80 MHz channel with fourMHz bandwidth PPDUs using frequency division multiple access (FDMA). Such embodiments may include, e.g., 1 PPDU perMHz bandwidth, 2 PPDU in a 40 MHz bandwidth, andPPDUs in an 80 MHz bandwidth. As a comparison,illustrates an embodiment of an orthogonal frequency division multiplexing (OFDM) transmissionfor the same channel as. The OFDM transmissionmay use the entire channel bandwidth.

2 FIG.C 20 2020 2022 2024 2026 2028 2 illustrates an embodiment of aMegahertz (MHz) bandwidthon a channel that illustrates different resource unit (RU) configurations,,, and. In OFDMA, for instance, an OFDM symbol is constructed of subcarriers, the number of which is a function of the physical layer protocol data unit (PPDU) (also referred to as the PHY frame) bandwidth. There are several subcarrier types: 1) Data subcarriers which are used for data transmission;) Pilot subcarriers which are utilized for phase information and parameter tracking; and 3) unused subcarriers which are not used for data/pilot transmission. The unused subcarriers are the direct current (DC) subcarrier, the Guard band subcarriers at the band edges, and the Null subcarriers.

2022 26 13 2024 5 52 26 2026 3 106 26 2028 2 242 The RU configurationillustrates an embodiment of nine RUs that each includetones (or subcarriers) for data transmission including the two sets oftones on either side of the DC. The RU configurationillustrates the same bandwidth divided intoRUs including four RUs withtones and one RU withtones about the DC for data transmission. The RU configurationillustrates the same bandwidth divided intoRUs including two RUs withtones and one RU withtones about the DC for data transmission. And the RU configurationillustrates the same bandwidth divided intoRUs including two RUs withtones about the DC for data transmission. Embodiments may be capable of additional or alternative bandwidths such as such as 40 MHz, 80 MHz, 160 MHz, 240 MHz, and 320 MHz.

26 52 106 242 484 996 242 242 Many embodiments support RUs of-tone RU,-tone RU,-tone RU,-tone RU,-tone RU,-tone RU, 2x996-tone RU, and 4x996-tone RU. In some embodiments, RUs that are the same size or larger than-tone RUs are defined as large size RUs and RUs that are smaller than-tones RUs are defined as small size RUs. In some embodiments, small size RUs can only be combined with small size RUs to form small size MRUs. In some embodiments, large size RUs can only be combined with large size RUs to form large size MRUs.

2 FIG.D 1 FIG.C 2100 20 2.4 5 6 1218 2100 6 illustrates an embodiment of a high efficiency (HE) multi-user (MU) PHY protocol data unit (HE MU PPDU)in the form of an 802.11, orthogonal frequency division multiple access (OFDMA) packet on aMHz channel of, e.g., aGHz link, aGHz link, aGHz link, or any other frequency. In some embodiments, the baseband processing circuitry, such as the baseband processing circuitryin, may transmit a HE MU PPDUtransmission on theGHz carrier frequency, optionally with beamforming. In some embodiments, the HE MU PPDU 2100 may comprise a MAC association response frame, an MAC reassociation response frame, a fast initial link setup (FILS) discovery frame, an open programmability system (OPS) frame, a disassociation frame, and deauthentication frame, and/or the like.

1006 1210 2210 2210 2210 1 FIG.A 1 FIG.C 2 FIG.F In some embodiments, the encryption logic circuitry of a mobile AP such as the mobile APinor the STAinmay generate a MAC management frameshown inand encrypt the frame body portion of the MAC management frame. In the present embodiment, the MAC management framemay optionally include a timestamp field with a TSF value indicative of the time of transmission of the MAC management frame in the MAC header of the MAC management frame. In other embodiments, the MAC management frame may include the timestamp field in the frame body of the MAC management frame. In such embodiments, the encryption logic circuitry may not encrypt the MAC management frame.

2100 2110 20 2110 2110 The HE MU PPDUmay comprise a legacy preambleto notify other devices in the vicinity of the source STA, such as an AP STA, that theMHz channel is in use for a duration included in the legacy preamble. The legacy preamblemay comprise one or more short training fields (L-STFs), one or more long training fields (L-LTFs), and one or more signal fields (L-SIG and RL-SIG).

2100 2120 6 2120 The HE MU PPDUmay also comprise a HE preambleto identify a subsequentGHz carrier link transmission as well as the STAs that are the targets of the transmission. Similarly, the HE preamblemay comprise one or more short training fields (HE-STFs), one or more long training fields (HE-LTFs), and one or more signal fields (HE-SIG).

2120 2100 2140 2140 2 FIG.D After the HE preamble, the HE MU PPDUmay comprise a data portionthat includes a single user (SU) or multiple user (MU) packet.illustrates the MU packet with four designated RUs. Note that the number and size of the RUs may vary between packets based on the number of target STAs and the types of payloads in the data portions.

2 FIG.E 2200 2200 2200 2200 depicts another embodiment of the MAC Management frame in the HE MU PPDU. In some embodiments, the HE MU PPDUmay be a frame format used for a DL transmission to one or more STAs. In the HE MU PPDU, the MAC management frame may comprise two legacy (L) short training fields (STFs) with an 8 microseconds duration each, a legacy (L) signal (SIG) field with a four microsecond duration, a repeated, legacy signal field (RL-SIG) with a 4 microsecond duration, and a U-SIG with 2 symbols having a 4 microsecond duration each. The HE MU PPDUformat may also comprise a HE signal field (HE-SIG) with 2 symbols at 4 microseconds each, an HE STF, a number of HE-LTFs, a data field, and a packet extension (PE) field. In some embodiments, the data field may comprise may be a MAC management frame.

2 FIG.F 2200 2210 As illustrated in, the data field of the HE MU PPDUmay comprise a MAC management frame. The data field of the PHY frame may comprise an MPDU (PSDU) such with the timestamp field optionally included in the MAC header or optionally included in the frame body. For MAC management frames that do not include the timestamp field in the frame body, the encryption logic circuitry may encrypt the frame body with a MFGTK, a MLO-MFGTK, a GTK, or a MLO-GTK.

2 2 6 6 2 6 3 2 0 4 4 The MAC management frame may include aoctet frame control field, aoctet duration field, aoctet address 1 field, aoctet addressfield, aoctet addressfield, aoctet sequence control field, aoroctet high-throughput (HT) control field, and the recipient MAC address or recipient ID field in the MAC header. MAC management frame may also include a variable length frame body field, and aoctet frame check sequence field comprising a value, such as a 32-bit cyclic redundancy code (CRC), to check the validity of and/or correct preceding frame.

The Duration field may be the time, in microseconds, required to transmit the pending management frame, plus, in some embodiments, one acknowledgement (ACK) frame and one or more short interframe spaces (SIFSs). If the calculated duration includes a fractional microsecond, that value may be rounded up to the next higher integer.

2100 The address 1 field of the MAC management frame may comprise the address of the intended receiver such as a non-AP STA of a non-AP MLD or a non-AP STA (without MLO). If the address 1 field includes an address for a MLD and the MLD is associated with a primary BSS, the encryption logic circuitry may encrypt the frame body with a MLO-MFGTK. If the address 1 field includes an address for a STA without MLO and the STA is associated with the primary BSS, the encryption logic circuitry may encrypt the frame body with a MFGTK. If the address 1 field includes an address for a MLD and the MLD is associated with a secondary BSS such as a guest network, the encryption logic circuitry may encrypt the frame body with a MLO-GTK. If the address 1 field includes an address for a STA without MLO and the STA is associated with the secondary BSS, the encryption logic circuitry may encrypt the frame body with a GTK. Note that the encryption logic circuitry may encrypt the frame body of each MAC management frame in the HE MU PPDU.

2 The addressfield may be the address the transmitter such as a mobile AP (with or without MLO) that transmits the MAC management frame. The address 3 field may be the basic service set identifier (BSSID) of the AP MLD of the non-collocated AP MLD.

The HT control field may be present in management frames as determined by the +HTC subfield of the frame control field.

2210 If the timestamp field is included in the MAC management frame, the timestamp field may include the value of the TSF timer of a mobile AP device at the time that the start of the data symbol containing the first bit of the timestamp field appears at the transmit antenna connector.

The frame body may include one or more fields and/or elements such as an RSNE, a RSNXE, a 802.11bi capabilities element, and/or the like. The frame check sequence (FCS) field may include a sequence of bits such as a 32-bit cyclic redundancy check (CRC).

2 FIG.G 2 FIG.H 2 FIG.I 2232 2234 2236 depicts an embodiment of an EAPOL-key frameused to transmit a KDE such as a KDE for a MLO-MFGTK, a MFGTK, a MLO-GTK, or a GTK. The Packet Body of each EAPOL protocol data unit (PDU) with a Packet Type of EAPOL-Key is a Key Descriptor comprising a Descriptor Type and Descriptor Body. The Descriptor Type field is one octet, representing an unsigned binary number to indicate if the key type is deprecated (value equals 1) or is an IEEE 802.11 key descriptor type (value equals 2). The descriptor body may include a KDE such as the MLO MFGTK KDE formatdepicted inor the MFGTK KDE formatdepicted in. The descriptor body may include other KDEs such as a MLO-GTK KDE or a GTK KDE.

2232 1006 1020 2232 1 FIG.A The EAPOL-key framemay be transmitted from a mobile AP to a STA such as the mobile APand the user devicesshown in. The mobile AP may transmit the EAPOL-key frameto a STA after establishing transient keys during a four-way handshake to transmit the MLO MFGTK KDE or the MFGTK KDE or in a group key handshake to update the MLO-MFGTK, the MFGTK, the MLO-GTK, or the GTK at the STA.

2 FIG.H 2234 depicts an embodiment of a MLO MFGTK KDE. The MLO MFGTK KDE may include a Key ID field may include a key identifier that is an index value to identify the MLO-MFGTK. The TX field may include a value of 1 or 0. If the value of the Tx field is 1, then the IEEE 802.1X component shall configure the temporal key derived from this KDE into its IEEE 802.11 MAC for both transmission and reception. If the value of the Tx field is 0, then the IEEE 802.1X component shall configure the temporal key derived from this KDE into its IEEE 802.11 MAC for reception only.

The reserved field may include reserved bits for this key or other keys. The linkID field may include an identifier for the link associated with the MLO-MFGTK. The PN field may comprise a packet number that the STA may use as a current replay counter value for the MLO-MFGTK. The MFGTK field may comprise key data for the MFGTK.

2 FIG.I 2236 depicts an embodiment of a MFGTK KDE. The MFGTK KDE may include a key ID field may include a key identifier that is an index value to identify the MFGTK. The TX field may include a value of 1 or 0. If the value of the TX field is 1, then the IEEE 802.1X component shall configure the temporal key derived from this KDE into its IEEE 802.11 MAC for both transmission and reception. If the value of the TX field is 0, then the IEEE 802.1X component shall configure the temporal key derived from this KDE into its IEEE 802.11 MAC for reception only.

The reserved fields may include reserved bits for this key or other keys. The PN field may comprise a packet number that the STA may use as a current replay counter value for the MFGTK. The MFGTK field may comprise be a key data for the MFGTK.

2 FIG.J 1 FIG.A 1 FIG. 2 FIG.K 2 FIG.N 2238 2238 2238 1006 1020 2238 2240 2244 depicts an embodiment of a FT response frameformat, which is a FT management type, action frame. The FT response frameis defined to support fast BSS transitions over the distribution system (DS). The FT response frameis transmitted by an AP STA such as the mobile APshown inand is responsive to a FT Request frame initiated by a STA such as the user devicesinto transition an association with the current AP STA to an association with a target AP STA. The current AP STA responds to the FT Request frame initiated by the STA with the FT response frame, which may include a MLO MFGTK subelement such as the MLO MFGTK subelementshown inor a MFGTK subelement such as the MFGTK subelementshown infor the target AP STA.

2238 6 2238 2240 2244 The FT response framemay comprise a category field that includes a code value such asto indicate that the frame is a Fast BSS transition action frame, an FT action field with a value to indicate that the frame is a FT response frame, a STA address field to indicate the MAC address of the FTO (FT originator) such as the STA that transmitted the FT response frame, a target AP address, and a FT request frame body. The FT target address may indicate the BSSID of the target AP and the FT request frame body may include an RSNE, a mobility domain element (MDE), and a fast BSS transition element (FTE). The FTE may include the MLO MFGTK subelementor the MFGTK subelement.

2 FIG.K 2 FIG.J 2240 2238 2240 depicts an embodiment of a MLO MFGTK subelementof a FT response frame such as the FT response frameshown in. The subelement ID field may include a value to indicate that the MLO MFGTK subelementis for a MLO-MFGTK. The length may include a value that is the number of octets in the Data field. The key info field may include a key ID field and a reserved field. The key ID field may comprise 2 bits (B0 and B1) and may include the value of the MLO-MFGTK.

2242 2 FIG.L The link info field may include a link ID field and a reserved field as shown in the link info fieldin. The link ID field may include an identifier (linkID) for the link between the non-AP STA and the mobile AP. The key length field may comprise a value indicative of the length of the key field in octets. The receive sequence counter (RSC) field may be the current RSC for the MLO-MFGTK being installed.

xdd The wrapped key field of the subelement may comprise a MFGTK and shall be wrapped using EAPOL-Key encryption key (KEK) or EAPOL-Key encryption key 2 (KEK2) and the appropriate key wrap algorithm. The padding consists of appending a single octet 0followed by zero or more 0x00 octets. When processing a received message, the receiver shall ignore this trailing padding. Addition of padding does not change the value of the key length field. Note that the length of the encrypted key field can be determined from the length of the MLO MFGTK subelement.

2 FIG.M 2 FIG.J 2244 2238 2244 depicts an embodiment of a MFGTK subelementof a FT response frame such as the FT response frameshown in. The subelement ID field may include a value to indicate that the MFGTK subelementis for a MFGTK. The length may include a value that is the number of octets in the data field. The key info field may include a key ID field and a reserved field. The key ID field may comprise 2 bits (B0 and B1) and may include the value of the MFGTK.

The key length field may comprise a value indicative of the length of the key field in octets. The RSC field may be the current RSC for the MFGTK being installed.

xdd The wrapped key field of the subelement may comprise a MFGTK and shall be wrapped using EAPOL-Key encryption key (KEK) or EAPOL-Key encryption key 2 (KEK2) and the appropriate key wrap algorithm. The padding consists of appending a single octet 0followed by zero or more 0x00 octets. When processing a received message, the receiver shall ignore this trailing padding. Addition of padding does not change the value of the key length field. Note that the length of the encrypted key field can be determined from the length of the MFGTK subelement.

2 FIG.N 1 FIG.A 1 FIG. 2 FIG.P 2 FIG.Q 2246 2246 1006 1020 2246 2248 2250 depicts an embodiment of a wireless network management (WNM) sleep mode response frameformat, which is a WNM management type, action frame. The WNM sleep mode response frameis transmitted by an AP STA such as the mobile APshown inand is responsive to a WNM sleep mode request frame initiated by a STA such as the user devicesinto enter the WNM sleep mode. The AP STA responds to the WNM sleep mode Request frame initiated by the STA with the WNM sleep mode response frame, which may include a WNM sleep mode MLO MFGTK subelement such as the WNM sleep mode MLO MFGTK subelementshown inor a WNM sleep mode MFGTK subelement such as the WNM sleep mode MFGTK subelementshown infor the AP STA.

2246 17 2246 2248 2250 The WNM sleep mode response framemay comprise a category field that includes a code value such as 10 or 11 to indicate that the frame is a WNM sleep mode management type, action frame, an WNM sleep mode action field with a value such asto indicate that the frame is a WNM sleep mode response frame, a dialog token field that is a nonzero value chosen by the non-AP STA sending the WNM Sleep Mode, a WNM sleep mode element, one or more traffic filtering service (TFS) request elements, and optionally an operating channel information (OCI) element. The WNM sleep mode element field contains a WNM Sleep Mode element that is requested by a non-AP STA such as a WNM sleep mode MLO MFGTK subelementor a WNM sleep mode MFGTK subelementto deliver a key.

The TFS Request Elements field contains one or more TFS Request elements to specify the traffic filters that are requested by a non-AP STA. The OCI Element field is optionally present, and contains an OCI element to describe an operating channel of the link between the non-AP STA and the mobile AP.

2 FIG.O 2 FIG.N 2248 2246 2248 depicts an embodiment of a WNM sleep mode MLO MFGTK subelementof a WNM sleep mode response frame such as the WNM sleep mode response frameshown in. The subelement ID field may include a value to indicate that the WNM sleep mode MLO MFGTK subelementis for a MLO-MFGTK. The length may include a value that is the number of octets in the data field. The key info field may include a key ID field and a reserved field. The key ID field may comprise 2 bits (B0 and B1) and may include the value of the MLO-MFGTK.

2242 2 FIG.L The link info field may include a link ID field and a reserved field as shown in the link info fieldin. The link ID field may include an identifier (linkID) for the link between the non-AP STA and the mobile AP. The key length field may comprise a value indicative of the length of the key field in octets. The RSC field may be the current RSC for the MLO-MFGTK being installed. The key field of the subelement is the MLO-MFGTK being distributed for the mobile AP operating on the link identified by the link id subfield.

2 FIG.P 2 FIG.N 2250 2246 2250 0 1 depicts an embodiment of a WNM sleep mode MFGTK subelementof a WNM sleep mode response frame such as the WNM sleep mode response frameshown in. The subelement ID field may include a value to indicate that the WNM sleep mode MFGTK subelementis for a MFGTK. The length may include a value that is the number of octets in the data field. The key info field may include a key ID field and a reserved field. The key ID field may comprise 2 bits (Band B) and may include the value of the MFGTK.

The key length field may comprise a value indicative of the length of the key field in octets. The RSC field may be the current RSC for the MFGTK being installed. The key field of the subelement is the MFGTK being distributed for the mobile AP on the link between the non-AP STA and the mobile AP.

3 FIG. 3000 3001 3001 3091 3092 3001 3000 depicts an embodiment of an apparatus to generate, transmit, receive, and interpret or decode PHY frames and MAC frames. In some embodiments, the apparatus may also include support for transmitting and/or receiving a wake-up radio packet (WUP) such as the wireless communications I/F of the wake-up radio (WUR) described in IEEE 802.11ba-2021. The apparatus comprises a transceivercoupled with baseband processing circuitry. The baseband processing circuitrymay comprise a MAC logic circuitryand PHY logic circuitry. In other embodiments, the baseband processing circuitrymay be included on the transceiver.

3091 3092 3001 3091 3092 3018 The MAC logic circuitryand PHY logic circuitrymay comprise code executing on processing circuitry of a baseband processing circuitry; circuitry to implement operations of functionality of the MAC or PHY; or a combination of both. The MAC logic circuitrymay determine a frame such as a group addressed management frame with a data field or payload encrypted with a cipher suite together with a MLO MFGTK or a MFGTK and the PHY logic circuitrymay determine the physical layer protocol data unit (PPDU) by prepending the frame, also called a MAC protocol data unit (MPDU) and the PHY service data unit (PSDU), with a preamble to cause the antenna arrayto transmit.

3000 3004 3006 3001 3001 3001 3 FIG. The transceivercomprises a receiverand a transmitter. Embodiments have many different combinations of modules to process data because the configurations are deployment specific.illustrates some of the modules that are common to many embodiments. In some embodiments, one or more of the modules may be implemented in circuitry separate from the baseband processing circuitry. In some embodiments, the baseband processing circuitrymay execute code in processing circuitry of the baseband processing circuitryto implement one or more of the modules.

3000 3110 3120 1024 1054 3110 3006 3110 3018 3006 1 FIG.A In the present embodiment, the transceiveralso includes WUR circuitryandsuch as the WUR circuitryand, respectively, shown in. The WUR circuitrymay comprise circuitry to use portions of the transmitter(a transmitter of the wireless communications I/F) to generate a WUR packet. For instance, the WUR circuitrymay generate, e.g., an OOK signal with OFDM symbols to generate a WUR packet for transmission via the antenna array. In other embodiments, the WUR may comprise an independent circuitry that does not use portions of the transmitter.

1210 1 FIG.C Note that a station such as the STAinmay comprise multiple transmitters to facilitate concurrent transmissions on multiple contiguous and/or non-contiguous carrier frequencies.

3006 3008 3066 3007 3009 3010 3060 3012 3015 3045 3040 3008 3006 3091 3064 3007 3008 3064 3009 The transmittermay comprise one or more of or all the modules including an encoder, a stream deparser, a frequency segment parser, an interleaver, a modulator, a frequency segment deparser, an OFDM, an Inverse Fast Fourier Transform (IFFT) module, a GI module, and a transmitter front end. The encoderof transmitterreceives and encodes a data stream destined for transmission from the MAC logic circuitrywith, e.g., a binary convolutional coding (BCC), a low-density parity check coding (LDPC), and/or the like. After coding, scrambling, puncturing and post-FEC (forward error correction) padding, a stream parsermay optionally divide the data bit streams at the output of the FEC encoder into groups of bits. The frequency segment parsermay receive data stream from encoderor streams from the stream parserand optionally parse each data stream into two or more frequency segments to build a contiguous or non-contiguous bandwidth based upon smaller bandwidth frequency segments. The interleavermay interleave rows and columns of bits to prevent long sequences of adjacent noisy bits from entering a BCC decoder of a receiver.

3010 3009 3010 3060 The modulatormay receive the data stream from interleaverand may impress the received data blocks onto a sinusoid of a selected frequency for each stream via, e.g., mapping the data blocks into a corresponding set of discrete amplitudes of the sinusoid, or a set of discrete phases of the sinusoid, or a set of discrete frequency shifts relative to the frequency of the sinusoid. In some embodiments, the output of modulatormay optionally be fed into the frequency segment deparserto combine frequency segments in a single, contiguous frequency bandwidth of, e.g., 320 MHz. Other embodiments may continue to process the frequency segments as separate data streams for, e.g. a non-contiguous 160+160 MHz bandwidth transmission.

3010 3012 3012 3011 3014 3011 3010 After the modulator, the data stream(s) are fed to an OFDM. The OFDMmay comprise a space-time block coding (STBC) module, and a digital beamforming (DBF) module. The STBC modulemay receive constellation points from the modulatorcorresponding to one or more spatial streams and may spread the spatial streams to a greater number of space-time streams. Further embodiments may omit the STBC.

3012 3014 The OFDMimpresses or maps the modulated data formed as OFDM symbols onto a plurality of orthogonal subcarriers so the OFDM symbols are encoded with the subcarriers or tones. The OFDM symbols may be fed to the DBF module. Generally, digital beam forming uses digital signal processing algorithms that operate on the signals received by, and transmitted from, an array of antenna elements. Transmit beamforming processes the channel state to compute a steering matrix that is applied to the transmitted signal to optimize reception at one or more receivers. This is achieved by combining elements in a phased antenna array in such a way that signals at particular angles experience constructive interference while others experience destructive interference.

3015 3045 3045 The IFFT modulemay perform an inverse discrete Fourier transform (IDFT) on the OFDM symbols to map on the subcarriers. The guard interval (GI) modulemay insert guard intervals by prepending to the symbol a circular extension of itself. The GI modulemay also comprise windowing to optionally smooth the edges of each symbol to increase spectral decay.

3045 3042 3040 3040 3044 3018 3044 The output of the GI modulemay enter the radioto convert the time domain signals into radio signals by combining the time domain signals with subcarrier frequencies to output into the transmitter front end module (TX FEM). The transmitter front endmay comprise a with a power amplifier (PA)to amplify the signal and prepare the signal for transmission via the antenna array. In many embodiments, entrance into a spatial reuse mode by a communications device such as a station or AP may reduce the amplification by the PAto reduce channel interference caused by transmissions.

3000 3016 3018 3018 3004 3006 The transceivermay also comprise duplexersconnected to antenna array. The antenna arrayradiates the information bearing signals into a time-varying, spatial distribution of electromagnetic energy that can be received by an antenna of a receiver. In several embodiments, the receiverand the transmittermay each comprise its own antenna(s) or antenna array(s).

3000 3004 3004 3050 3054 3052 3052 3055 The transceivermay comprise a receiverfor receiving, demodulating, and decoding information bearing communication signals. The receivermay comprise a receiver front-end module (RX FEM)to detect the signal, detect the start of the packet, remove the carrier frequency, and amplify the subcarriers via a low noise amplifier (LNA)to output to the radio. The radiomay convert the radio signals into time domain signals to output to the GI moduleby removing the subcarrier frequencies from each tone of the radio signals.

3004 3055 3019 3055 3019 The receivermay comprise a GI moduleand a fast Fourier transform (FFT) module. The GI modulemay remove the guard intervals and the windowing and the FFT modulemay transform the communication signals from the time domain to the frequency domain.

3004 3022 3062 3024 3025 3027 3066 3026 3022 3022 The receivermay also comprise an OFDM, a frequency segment parser, a demodulator, a deinterleaver, a frequency segment deparser, a stream deparser, and a decoder. An equalizer may output the weighted data signals for the OFDM packet to the OFDM. The OFDMextracts signal information as OFDM symbols from the plurality of subcarriers onto which information-bearing communication signals are modulated.

3022 3020 3021 3020 3020 3004 3021 The OFDMmay comprise a DBF module, and an STBC module. The received signals are fed from the equalizer to the DBF module. The DBF modulemay comprise algorithms to process the received signals as a directional transmission directed toward to the receiver. And the STBC modulemay transform the data streams from the space-time streams to spatial streams.

3021 3062 The output of the STBC modulemay enter a frequency segment parserif the communication signal is received as a single, contiguous bandwidth signal to parse the signal into, e.g., two or more frequency segments for demodulation and deinterleaving.

3024 3025 3027 3062 3026 3024 3091 The demodulatordemodulates the spatial streams. Demodulation is the process of extracting data from the spatial streams to produce demodulated spatial streams. The deinterleavermay deinterleave the sequence of bits of information. The frequency segment deparsermay optionally deparse frequency segments as received if received as separate frequency segment signals or may deparse the frequency segments determined by the optional frequency segment parser. The decoderdecodes the data from the demodulatorand transmits the decoded information, the MPDU, to the MAC logic circuitry.

3091 3091 3091 The MAC logic circuitrymay parse the MPDU (or MSDU or MAC frame) based upon a format defined in the communications device for a frame to determine the particular type of frame by determining the type value and the subtype value. For MPDUs with encrypted group addressed management frames, the MAC logic circuitrymay decrypt the data field or payload with a cipher suite together with a MLO-MFGTK or a MFGTK. The MAC logic circuitrymay then interpret the remainder of MPDU.

3 FIG. 3092 While the description offocuses primarily on a single spatial stream system for simplicity, many embodiments are capable of multiple spatial stream transmissions and use parallel data processing paths for multiple spatial streams from the PHY logic circuitrythrough to transmission. Further embodiments may include the use of multiple encoders to afford implementation flexibility.

4 FIG.A 1 FIG.A 1 FIG.C 4000 4010 1006 1210 illustrates a flow diagram of illustrative processfor communication of a cipher suite for use with a set of one or more keys to encrypt group addressed management frames. At element, an AP STA (e.g., the mobile APofand the AP STAof) may generate a management frame such as a beacon frame, a probe response frame, an association response frame, or a reassociation response frame with a capability bit set to indicate that RSN is supported or enabled and a cipher suite field with a cipher suite to support encryption of group addressed management frames. In some embodiments, the management frame may comprise an RSNE and the RSNE comprises the cipher suite field. The cipher suite field to indicate the cipher suite for encryption for the group addressed management frames such as beacon frames, probe response frames, fast initial link setup (FILS) discovery frames, open programmability system (OPS) frames, disassociation frames, and deauthentication frames. The cipher suite may indicate a cipher-block chaining message protocol (CCMP) or a Galois/counter mode (GCM) protocol (GCMP) for use in conjunction with the set of one or more keys for encryption for the group addressed management frames.

In other embodiments, the management frame may comprise an RSNXE with a cipher suite field to indicate the cipher suite for encryption for the group addressed management frames. The cipher suite may indicate a cipher-block chaining message protocol (CCMP) or a Galois/counter mode (GCM) protocol (GCMP) for use in conjunction with the set of one or more keys for encryption for the group addressed management frames. In some embodiments, the RSNXE may comprise the capability bit to indicate group management frame encryption support or enablement. In other embodiments, another capabilities element such as a 802.11bi capabilities element may comprise the capability bit to indicate group management frame encryption support or enablement. In some embodiments, the cipher suite used together with the set of one or more keys indicates CCMP-128, CCMP-256, GCMP-128, or GCMP-256 for encryption of the group addressed management frames.

4015 After generation of the management frame, the encryption logic circuitry of the AP STA may cause transmission of the management frame to one or more STAs (element). For instance, if the management frame is a beacon frame, the AP STA may advertise capabilities of RSN in an RSNE and/or an RSNXE to STAs within range of a wireless transmission. At least one of the STAs may receive the beacon frame and decode the beacon frame to determine if the STA should associate with the AP STA. The STA may determine that the AP STA has a BSSID with which the STA is instructed to associate or the STA may determine to associate with the AP STA based on capabilities of the AP STA such as the RSN capabilities in the RSNE or the RSNXE.

In other embodiments, the STA may transmit a probe response frame to probe the area for the AP STA and receive a probe response frame comprising the cipher suite field with the cipher suite as well as a capability bit indicative of encryption of group addressed management frames. The capability may advantageously protect PII of the user of the STA.

In still another embodiment, the STA may, in response to a determination of the existence of the AP STA through a neighbor report, a beacon from the AP STA, or another source, generate a transmit an association request frame or a reassociation request frame to the AP STA. The AP STA may respond to the association request frame or reassociation request frame with an association response frame or a reassociation response frame that comprises a cipher suite field with a cipher suite that can be used in conjunction with the one or more keys to encrypt group addressed management frames. In some embodiments, the association response frame or a reassociation response frame may comprise a capability bit set to indicate a capability to encrypt group addressed management frames. In some embodiments, the AP STA may require an IEEE 802.11 authentication exchange prior to association with the STA prior to responding with the association response frame.

4 FIG.B 1 FIG.A 1 FIG.C 1 FIG.A 1 FIG.C 4100 1006 1210 1020 1230 4100 Referring to, the flowchartmay establish an RSNA between an AP STA (e.g., the mobile APofand the AP STAof) and a STA (e.g., user devicesinand STAin). The flowchartmay begin with invoking an authentication process such as open system, FILS, SAE, or IEEE 802.1X. The encryption logic circuitry of the STA may identify the AP as an RSNA AP from the AP’s beacon, dmg beacon, announce, information response, or probe response frames. The STA may perform the authentication process and negotiates cipher suites during the association process. The encryption logic circuitry of the STA interact with the encryption logic circuitry of the AP to establish one or more temporal keys by executing a key management algorithm and then invoking protection to protect the data link by programming the cipher suites and an established temporal into the MAC.

4115 4120 After establishing protection of the data link with the MAC, the encryption logic circuitry of the AP STA may generate a key message with the a key such as a MFGTK, a GTK, a MLO-MFGTK, or a MLO-GTK at elementand transmit the key to the encryption logic circuitry of the STA at element. After the STA confirms receipt of the key, the AP STA and the STA may install the key and use the key together with the cipher suite for encryption and decryption of group addressed management frames. In many embodiments, the MFGTK, a GTK, a MLO-MFGTK, or a MLO-GTK received by the STA may be a pairwise symmetric key used along with the cipher suite for group addressed management frames for encryption or decryption of group addressed management frames. In other embodiments, STA may receive an asymmetric key only be used along with the cipher suite for group addressed management frames for decryption of the encrypted group addressed management frames.

4 FIG.C 1 FIG.A 1 FIG.C 1 FIG.A 1 FIG.C 4200 1006 1210 1020 1230 4210 At, there is shown a flowchartto illustrate an exchange between a first AP STA (e.g., the mobile APofand the AP STAof) and a STA (e.g., user devicesinand STAin) to transmit a MFGTK or MLO-MFGTK from the first AP STA to the STA. At element, the first AP STA may receive a FT BSS transition request frame from the STA to transition the STA from the first AP STA to a target AP STA.

4215 The first AP STA may communicate with the target AP STA to determine one or more keys for protection of the group addressed management frames between the target AP STA and the STA. The target AP STA may communicate the one or more keys to the first AP STA at elementto pass the one or more keys to the first AP STA.

4220 4225 After receipt of the one or more keys from the target AP STA, the encryption logic circuitry of the AP STA may generate a FT BSS transition response frame comprising the one or more keys such as the MFGTK at elementand cause the PHY of the first AP STA to transmit the FT BSS transition response frame to the STA via a radio coupled with one or more antennas of the first AP STA at element.

4 FIG.D 1 FIG.A 1 FIG.C 1 FIG.A 1 FIG.C 4300 1006 1210 1020 1230 4310 4315 At, there is shown a flowchartto illustrate an exchange between an AP STA (e.g., the mobile APofand the AP STAof) and a STA (e.g., user devicesinand STAin) to transmit a MFGTK or MLO-MFGTK from the AP STA to the STA. At element, the AP STA may receive a WNM sleep mode request frame from the STA to transition the STA into a sleep mode. In response to the request, the AP STA may generate a WNM sleep mode response frame including an updated or new key such as a MFGTK or a MLO-MFGTK at element.

4325 After generating the WNM sleep mode response frame including an updated or new key, the encryption logic circuitry of the AP STA may cause the PHY of the AP STA to transmit the WNM sleep mode response frame to the STA via a radio coupled with one or more antennas of the AP STA at element.

4 FIG.E 1 FIG.A 1 FIG.C 1 FIG.A 1 FIG.C 4400 1006 1210 1020 1230 4410 At, there is shown a flowchartto illustrate a communication of an encrypted group addressed management frame from an AP STA (e.g., the mobile APofand the AP STAof) to a STA (e.g., user devicesinand STAin). At element, the AP STA may generate a group addressed management frame such as a beacon frame, a probe response frame, a fast initial link setup (FILS) discovery frame, an open programmability system (OPS) frame, a disassociation frame, or a deauthentication frame. Prior to passing the MSDU from the MAC to the PHY, the encryption logic circuitry may encrypt the data field or payload of the MSDU with a MFGTK or MLO-MFGTK together with a cipher suite for encryption of group addressed management frames.

4415 After encryption of the data field or payload portion of the MSDU, the encryption logic circuitry may pass the MSDU as a MPDU to the PHY of the AP STA for transmission to the STA. The PHY may cause transmission of the encrypted group addressed management frame to the STA at element.

4 FIG.F 1 FIG.A 1 FIG.C 1 FIG.A 1 FIG.C 4500 1006 1210 1020 1230 4510 4515 At, there is shown a flowchartto illustrate a communication of an encrypted group addressed management from an AP STA (e.g., the mobile APofand the AP STAof) to a STA (e.g., user devicesinand STAin). At element, the STA may receive an encrypted group addressed management frame within a PPDU. The PHY may decode the PPDU to determine one or more MPDUs in the payload of the PPDU and pass the one or more MPDUs to the MAC as MSDUs at element.

After receipt of the MSDUs, the encryption logic circuitry of the STA may decrypt the data field of the one or more MSDUs to determine the data fields of the one or more MSDUs. The encryption logic circuitry of the STA may decrypt the data fields using the MFGTK, MLO-MFGTK, GTK, or MLO-GTK together with the cipher suite for group addressed management frames.

5 FIG. 5 FIG. 1 FIG.A 1 FIG.A 500 1006 1028 500 1020 1024 1026 1024 1026 shows a functional diagram of an exemplary communication station, in accordance with one or more example embodiments of the present disclosure. In one embodiment,illustrates a functional block diagram of a communication station that may be suitable for use as a mobile AP() or a user device() in accordance with some embodiments. The communication stationmay also be suitable for use as other user device(s)such as the user devicesand/or. The user devicesand/ormay include, e.g., a handheld device, a mobile device, a cellular telephone, a smartphone, a tablet, a netbook, a wireless terminal, a laptop computer, a wearable computer device, a femtocell, a high data rate (HDR) subscriber station, an access point, an access terminal, or other personal communication system (PCS) device.

500 502 510 501 502 500 506 508 502 506 The communication stationmay include communications circuitryand a transceiverfor transmitting and receiving signals to and from other communication stations using one or more antennas. The communications circuitrymay include circuitry that can operate the physical layer (PHY) communications and/or medium access control (MAC) communications for controlling access to the wireless medium, and/or any other communications layers for transmitting and receiving signals. The communication stationmay also include processing circuitryand memoryarranged to perform the operations described herein. In some embodiments, the communications circuitryand the processing circuitrymay be configured to perform operations detailed in the above figures, diagrams, and flows.

502 502 502 506 500 501 502 508 506 508 508 In accordance with some embodiments, the communications circuitrymay be arranged to contend for a wireless medium and configure frames or packets for communicating over the wireless medium. The communications circuitrymay be arranged to transmit and receive signals. The communications circuitrymay also include circuitry for modulation/demodulation, upconversion/downconversion, filtering, amplification, etc. In some embodiments, the processing circuitryof the communication stationmay include one or more processors. In other embodiments, two or more antennasmay be coupled to the communications circuitryarranged for sending and receiving signals. The memorymay store information for configuring the processing circuitryto perform operations for configuring and transmitting message frames and performing the various operations described herein. The memorymay include any type of memory, including non-transitory memory, for storing information in a form readable by a machine (e.g., a computer). For example, the memorymay include a computer-readable storage device, read-only memory (ROM), random-access memory (RAM), magnetic disk storage media, optical storage media, flash-memory devices and other storage devices and media.

500 In some embodiments, the communication stationmay be part of a portable wireless communication device, such as a personal digital assistant (PDA), a laptop or portable computer with wireless communication capability, a web tablet, a wireless telephone, a smartphone, a wireless headset, a pager, an instant messaging device, a digital camera, an access point, a television, a medical device (e.g., a heart rate monitor, a blood pressure monitor, etc.), a wearable computer device, or another device that may receive and/or transmit information wirelessly.

500 501 501 In some embodiments, the communication stationmay include one or more antennas. The antennasmay include one or more directional or omnidirectional antennas, including, for example, dipole antennas, monopole antennas, patch antennas, loop antennas, microstrip antennas, or other types of antennas suitable for transmission of RF signals. In some embodiments, instead of two or more antennas, a single antenna with multiple apertures may be used. In these embodiments, each aperture may be considered a separate antenna. In some multiple-input multiple-output (MIMO) embodiments, the antennas may be effectively separated for spatial diversity and the different channel characteristics that may result between each of the antennas and the antennas of a transmitting station.

500 In some embodiments, the communication stationmay include one or more of a keyboard, a display, a non-volatile memory port, multiple antennas, a graphics processor, an application processor, speakers, and other mobile device elements. The display may be an LCD screen including a touch screen.

500 500 Although the communication stationis illustrated as having several separate functional elements, two or more of the functional elements may be combined and may be implemented by combinations of software-configured elements, such as processing elements including digital signal processors (DSPs), and/or other hardware elements. For example, some elements may include one or more microprocessors, DSPs, field- programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), radio- frequency integrated circuits (RFICs) and combinations of various hardware and logic circuitry for performing at least the functions described herein. In some embodiments, the functional elements of the communication stationmay refer to one or more processes operating on one or more processing elements.

500 Certain embodiments may be implemented in one or a combination of hardware, firmware, and software. Other embodiments may also be implemented as instructions stored on a computer-readable storage device, which may be read and executed by at least one processor to perform the operations described herein. A computer-readable storage device may include any non-transitory memory mechanism for storing information in a form readable by a machine (e.g., a computer). For example, a computer-readable storage device may include read-only memory (ROM), random-access memory (RAM), magnetic disk storage media, optical storage media, flash-memory devices, and other storage devices and media. In some embodiments, the communication stationmay include one or more processors and may be configured with instructions stored on a computer-readable storage device.

6 FIG. 1 FIG.A 600 1006 1020 600 600 600 600 illustrates a block diagram of an example of a machineor system upon which any one or more of the techniques (e.g., methodologies) discussed herein may be performed. For instance, the machine may comprise an AP STA such as the mobile APand/or one of the user devicesshown in. In other embodiments, the machinemay operate as a standalone device or may be connected (e.g., networked) to other machines. In a networked deployment, the machinemay operate in the capacity of a server machine, a client machine, or both in server-client network environments. In an example, the machinemay act as a peer machine in peer-to-peer (P2P) (or other distributed) network environments. The machinemay be a personal computer (PC), a tablet PC, a set-top box (STB), a personal digital assistant (PDA), a mobile telephone, a wearable computer device, a web appliance, a network router, a switch or bridge, or any machine capable of executing instructions (sequential or otherwise) that specify actions to be taken by that machine, such as a base station. Further, while only a single machine is illustrated, the term “machine” shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein, such as cloud computing, software as a service (SaaS), or other computer cluster configurations.

Examples, as described herein, may include or may operate on logic or a number of components, modules, or mechanisms. Modules are tangible entities (e.g., hardware) capable of performing specified operations when operating. A module includes hardware. In an example, the hardware may be specifically configured to carry out a specific operation (e.g., hardwired). In another example, the hardware may include configurable execution units (e.g., transistors, circuits, etc.) and a computer readable medium containing instructions where the instructions configure the execution units to carry out a specific operation when in operation. The configuring may occur under the direction of the execution units or a loading mechanism. Accordingly, the execution units are communicatively coupled to the computer-readable medium when the device is operating. In this example, the execution units may be a member of more than one module. For example, under operation, the execution units may be configured by a first set of instructions to implement a first module at one point in time and reconfigured by a second set of instructions to implement a second module at a second point in time.

600 602 604 606 608 608 608 604 602 The machine (e.g., computer system)may include a hardware processor(e.g., a central processing unit (CPU), a graphics processing unit (GPU), a hardware processor core, or any combination thereof), a main memoryand a static memory, some or all of which may communicate with each other via one or more interlinks (e.g., buses or high speed interconnects). Note that the single set of interlinksmay be representative of the physical interlinks in some embodiments but is not representative of the physical interlinksin other embodiments. For example, the main memorymay couple directly with the hardware processorvia high speed interconnects or a main memory bus. The high speed interconnects typically connect two devices and the bus is generally designed to interconnect two or more devices and include an arbitration scheme to provide fair access to the bus by the two or more devices.

600 632 610 612 614 610 612 614 600 616 618 619 620 630 628 600 634 1218 1248 602 604 616 619 1 FIG.C The machinemay further include a power management device, a graphics display device, an alphanumeric input device(e.g., a keyboard), and a user interface (UI) navigation device(e.g., a mouse). In an example, the graphics display device, alphanumeric input device, and UI navigation devicemay be a touch screen display. The machinemay additionally include a storage device (i.e., drive unit), a signal generation device(e.g., a speaker), a encryption logic circuitry, a network interface device/transceivercoupled to antenna(s), and one or more sensors, such as a global positioning system (GPS) sensor, a compass, an accelerometer, or other sensor. The machinemay include an output controller, such as a serial (e.g., universal serial bus (USB), parallel, or other wired or wireless (e.g., infrared (IR), near field communication (NFC), etc.) connection to communicate with or control one or more peripheral devices (e.g., a printer, a card reader, etc.)). The operations in accordance with one or more example embodiments of the present disclosure may be carried out by a baseband processor such as the baseband processing circuitryand/orshown in. The baseband processor may be configured to generate corresponding baseband signals. The baseband processor may further include physical layer (PHY) and medium access control layer (MAC) circuitry, and may further interface with the hardware processorfor generation and processing of the baseband signals and for controlling operations of the main memory, the storage device, and/or the encryption logic circuitry. The baseband processor may be provided on a single radio card, a single chip, or an integrated circuit (IC).

616 622 624 624 604 606 602 600 602 604 606 616 The storage devicemay include a machine readable mediumon which is stored one or more sets of data structures or instructions(e.g., software) embodying or utilized by any one or more of the techniques or functions described herein. The instructionsmay also reside, completely or at least partially, within the main memory, within the static memory, or within the hardware processorduring execution thereof by the machine. In an example, one or any combination of the hardware processor, the main memory, the static memory, or the storage devicemay constitute machine-readable media.

619 4000, 4100, 4200, 4300, 4400, 4500 4 4 FIGS.A-F The encryption logic circuitrymay carry out or perform any of the operations and processes (e.g., processesandshown in) described and shown above.

619 619 It is understood that the above are only a subset of what the encryption logic circuitrymay be configured to perform and that other functions included throughout this disclosure may also be performed by the encryption logic circuitry.

622 624 While the machine-readable mediumis illustrated as a single medium, the term "machine-readable medium" may include a single medium or multiple media (e.g., a centralized or distributed database, and/or associated caches and servers) configured to store the one or more instructions.

Various embodiments may be implemented fully or partially in software and/or firmware. This software and/or firmware may take the form of instructions contained in or on a non-transitory computer-readable storage medium. Those instructions may then be read and executed by one or more processors to enable performance of the operations described herein. The instructions may be in any suitable form, such as but not limited to source code, compiled code, interpreted code, executable code, static code, dynamic code, and the like. Such a computer-readable medium may include any tangible non-transitory medium for storing information in a form readable by one or more computers, such as but not limited to read only memory (ROM); random access memory (RAM); magnetic disk storage media; optical storage media; a flash memory, etc.

600 600 The term “machine-readable medium” may include any medium that is capable of storing, encoding, or carrying instructions for execution by the machineand that cause the machineto perform any one or more of the techniques of the present disclosure, or that is capable of storing, encoding, or carrying data structures used by or associated with such instructions. Non-limiting machine-readable medium examples may include solid-state memories and optical and magnetic media. In an example, a massed machine-readable medium includes a machine-readable medium with a plurality of particles having resting mass. Specific examples of massed machine-readable media may include non-volatile memory, such as semiconductor memory devices (e.g., electrically programmable read-only memory (EPROM), or electrically erasable programmable read-only memory (EEPROM)) and flash memory devices; magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD- ROM disks.

624 626 620 620 626 620 600 The instructionsmay further be transmitted or received over a communications networkusing a transmission medium via the network interface device/transceiverutilizing any one of a number of transfer protocols (e.g., frame relay, internet protocol (IP), transmission control protocol (TCP), user datagram protocol (UDP), hypertext transfer protocol (HTTP), etc.). Example communications networks may include a local area network (LAN), a wide area network (WAN), a packet data network (e.g., the Internet), mobile telephone networks (e.g., cellular networks), plain old telephone (POTS) networks, wireless data networks (e.g., Institute of Electrical and Electronics Engineers (IEEE) 802.11 family of standards known as Wi-Fi®, IEEE 802.16 family of standards known as WiMax®), IEEE 802.15.4 family of standards, and peer-to-peer (P2P) networks, among others. In an example, the network interface device/transceivermay include one or more physical jacks (e.g., Ethernet, coaxial, or phone jacks) or one or more antennas to connect to the communications network. In an example, the network interface device/transceivermay include a plurality of antennas to wirelessly communicate using at least one of single-input multiple-output (SIMO), multiple-input multiple-output (MIMO), or multiple-input single-output (MISO) techniques. The term “transmission medium” shall be taken to include any intangible medium that is capable of storing, encoding, or carrying instructions for execution by the machineand includes digital or analog communications signals or other intangible media to facilitate communication of such software.

The operations and processes described and shown above may be carried out or performed in any suitable order as desired in various implementations. Additionally, in certain implementations, at least a portion of the operations may be carried out in parallel. Furthermore, in certain implementations, less than or more than the operations described may be performed.

7 FIG. 6 FIG. 7000 619 7000 7000 7000 illustrates an example of a storage mediumto store encryption logic such as logic to implement the encryption logic circuitryshown inand/or the other logic discussed herein for defining one or more procedures, one or more keys, cipher suites, capability bits, replay counters, frames, KDEs, subelements, and fields for encryption and decryption of group addressed management frames. Storage mediummay comprise an article of manufacture. In some examples, storage mediummay include any non-transitory computer readable medium or machine-readable medium, such as an optical, magnetic or semiconductor storage. Storage mediummay store diverse types of computer executable instructions, such as instructions to implement logic flows and/or techniques described herein. Examples of a computer readable or machine-readable storage medium may include any tangible media capable of storing electronic data, including volatile memory or non-volatile memory, removable or non-removable memory, erasable or non-erasable memory, writeable or re-writeable memory, and so forth. Examples of computer executable instructions may include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, object-oriented code, visual code, and the like.

8 FIG. 1 1 FIGS.A andC 8 FIG. 1 FIG.A 8000 1006 1020 1210 1210 1230 1290 1292 1294 1296 1298 8000 8010 8030 1222 1252 8000 illustrates an example computing platformsuch as the mobile AP, user devices, AP STA, and STAs,,,,,, andin. In some examples, as shown in, computing platformmay include a processing component, other platform components or a communications interfacesuch as the wireless network interfacesandshown in. According to some examples, computing platformmay be a computing device such as a server in a system such as a data center or server farm that supports a manager or controller for managing configurable computing resources as mentioned above.

8010 8015 8010 8020 According to some examples, processing componentmay execute processing operations or logic for apparatusdescribed herein. Processing componentmay include various hardware elements, software elements, or a combination of both. Examples of hardware elements may include devices, logic devices, components, processors, microprocessors, circuits, processor circuits, circuit elements (e.g., transistors, resistors, capacitors, inductors, and so forth), integrated circuits (ICs), application specific integrated circuits (ASIC), programmable logic devices (PLD), digital signal processors (DSP), field programmable gate array (FPGA), memory units, logic gates, registers, semiconductor device, chips, microchips, chip sets, and so forth. Examples of software elements, which may reside in the storage medium, may include software components, programs, applications, computer programs, application programs, device drivers, system programs, software development programs, machine programs, operating system software, middleware, firmware, software modules, routines, subroutines, functions, methods, procedures, software interfaces, application program interfaces (API), instruction sets, computing code, computer code, code segments, computer code segments, words, values, symbols, or any combination thereof. While discussions herein describe elements of embodiments as software elements and/or hardware elements, decisions to implement an embodiment using hardware elements and/or software elements may vary in accordance with any number of design considerations or factors, such as desired computational rate, power levels, heat tolerances, processing cycle budget, input data rates, output data rates, memory resources, data bus speeds and other design or performance constraints.

8025 In some examples, other platform componentsmay include common computing elements, such as one or more processors, multi-core processors, co-processors, memory units, chipsets, controllers, peripherals, interfaces, oscillators, timing devices, video cards, audio cards, multimedia input/output (I/O) components (e.g., digital displays), power supplies, and so forth. Examples of memory units may include without limitation various types of computer readable and machine readable storage media in the form of one or more higher speed memory units, such as read-only memory (ROM), random-access memory (RAM), dynamic RAM (DRAM), Double-Data-Rate DRAM (DDRAM), synchronous DRAM (SDRAM), static RAM (SRAM), programmable ROM (PROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, polymer memory such as ferroelectric polymer memory, ovonic memory, phase change or ferroelectric memory, silicon-oxide-nitride-oxide-silicon (SONOS) memory, magnetic or optical cards, an array of devices such as Redundant Array of Independent Disks (RAID) drives, solid state memory devices (e.g., universal serial bus (USB) memory), solid state drives (SSD) and any other type of storage media suitable for storing information.

8030 8030 In some examples, communications interfacemay include logic and/or features to support a communication interface. For these examples, communications interfacemay include one or more communication interfaces that operate according to various communication protocols or standards to communicate over direct or network communication links. Direct communications may occur via use of communication protocols or standards described in one or more industry standards (including progenies and variants) such as those associated with the Peripheral Component Interconnect (PCI) Express specification. Network communications may occur via use of communication protocols or standards such as those described in one or more Ethernet standards promulgated by the Institute of Electrical and Electronics Engineers (IEEE). For example, one such Ethernet standard may include IEEE 802.3-2012, Carrier sense Multiple access with Collision Detection (CSMA/CD) Access Method and Physical Layer Specifications, Published in December 2012 (hereinafter “IEEE 802.3”). Network communication may also occur according to one or more OpenFlow specifications such as the OpenFlow Hardware Abstraction API Specification. Network communications may also occur according to Infiniband Architecture Specification, Volume 1, Release 1.3, published in March 2015 (“the Infiniband Architecture specification”).

8000 8000 8000 Computing platformmay be part of a computing device that may be, for example, a server, a server array or server farm, a web server, a network server, an Internet server, a work station, a mini-computer, a main frame computer, a supercomputer, a network appliance, a web appliance, a distributed computing system, multiprocessor systems, processor-based systems, or combination thereof. Accordingly, various embodiments of the computing platformmay include or exclude functions and/or specific configurations of the computing platformdescribed herein.

8000 8000 The components and features of computing platformmay comprise any combination of discrete circuitry, ASICs, logic gates and/or single chip architectures. Further, the features of computing platformmay comprise microcontrollers, programmable logic arrays and/or microprocessors or any combination of the foregoing where suitably appropriate. Note that hardware, firmware and/or software elements may be collectively or individually referred to herein as “logic”.

One or more aspects of at least one example may comprise representative instructions stored on at least one machine-readable medium which represents various logic within the processor, which when read by a machine, computing device or system causes the machine, computing device or system to fabricate logic to perform the techniques described herein. Such representations, known as “IP cores” may be stored on a tangible, machine readable medium and supplied to various customers or manufacturing facilities to load into the fabrication machines that make the logic or processor.

Some examples may include an article of manufacture or at least one computer-readable medium. A computer-readable medium may include a non-transitory storage medium to store logic. In some examples, the non-transitory storage medium may include one or more types of computer-readable storage media capable of storing electronic data, including volatile memory or non-volatile memory, removable or non-removable memory, erasable or non-erasable memory, writeable or re-writeable memory, and so forth. In some examples, the logic may include various software elements, such as software components, programs, applications, computer programs, application programs, system programs, machine programs, operating system software, middleware, firmware, software modules, routines, subroutines, functions, methods, procedures, software interfaces, API, instruction sets, computing code, computer code, code segments, computer code segments, words, values, symbols, or any combination thereof.

According to some examples, a computer-readable medium may include a non-transitory storage medium to store or maintain instructions that when executed by a machine, computing device or system, cause the machine, computing device or system to perform methods and/or operations in accordance with the described examples. The instructions may include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, and the like. The instructions may be implemented according to a predefined computer language, manner, or syntax, for instructing a machine, computing device or system to perform a certain function. The instructions may be implemented using any suitable high-level, low-level, object-oriented, visual, compiled and/or interpreted programming language.

Some examples may be described using the expression "coupled" and "connected" along with their derivatives. These terms are not necessarily intended as synonyms for each other. For example, descriptions using the terms “connected” and/or “coupled” may indicate that two or more elements are in direct physical or electrical contact with each other. The term "coupled,” however, may also mean that two or more elements are not in direct contact with each other, but yet still co-operate or interact with each other.

Several embodiments have one or more potentially advantages effects. For instance, use of encryption in all current robust group addressed management frames, advantageously protects PII for mobile APs. Defining one or more keys and cipher suites for encryption of group addressed management frames, advantageously facilitates encryption of group addressed management frames. Defining a capability bit for support or enablement of group addressed management frames, advantageously communicates desirable a capability to STAs. Encrypting disassociation frames advantageously avoids or prevents leakage of vendor specific elements. Encrypting deauthentication frames advantageously avoids or prevents leakage of vendor specific elements.

The following examples pertain to further embodiments. Specifics in the examples may be used anywhere in one or more embodiments.

Example 1 is a device comprising memory; and logic circuitry coupled to the memory, the logic circuitry configured to generate a management frame comprising a robust security network (RSN) element (RSNE), the management frame comprising a cipher suite field with a cipher suite used together with a set of one or more keys to encrypt the group addressed management frames; and cause transmission of the management frame to one or more stations (STAs). In Example 2, the device of Example 1, wherein the logic circuitry comprises baseband processing circuitry and further comprising a radio coupled with the baseband processing circuitry, and one or more antennas coupled with the radio to transmit the management frame. In Example 3, the device of Example 1, wherein the RSNE comprises the cipher suite field, the cipher suite field to indicate the cipher suite for encryption for the group addressed management frames, the cipher suite to indicate a cipher-block chaining message protocol (CCMP) or a Galois/counter mode (GCM) protocol (GCMP) to indicate use of encryption for the group addressed management frames. In Example 4, the device of Example 3, wherein a group management cipher suite field of the RSNE comprises the cipher suite used together with the set of one or more keys for encryption of the group addressed management frames. In Example 5, the device of Example 1, wherein the cipher suite used together with the set of one or more keys for encryption of the group addressed management frames is defined in a RSN extension element (RSNXE) in the management frame. In Example 6, the device of Example 1, the logic circuitry further configured to cause transmission of a management frame group temporal key (MFGTK) in a key field of a MFGTK key descriptor element (KDE) or a MFGTK in a key field of a MFGTK subelement. In Example 7, the device of Example 6, wherein the MFGTK KDE or MFGTK subelement comprises a linkID field for multi-link operation (MLO). In Example 8, the device of Example 6, wherein the MFGTK subelement is defined under a Fast basic service set (BSS) Transition element (FTE) or a wireless network management (WNM) Sleep Mode Response frame. In Example 9, the device of Example 1, wherein the group addressed management frames comprise beacon frames, probe response frames, fast initial link setup (FILS) discovery frames, open programmability system (OPS) frames, disassociation frames, and deauthentication frames. In Example 10, the device of Example 1, wherein the management frame comprises a capability bit to indicate that encryption of the group addressed management frames is supported or is enabled. In Example 11, the device of Example 1, wherein the cipher suite used together with the set of one or more keys indicates CCMP-128, CCMP-256, GCMP-128, or GCMP-256 for encryption of the group addressed management frames. In Example 12, the device of Example 1, wherein a capability bit to indicate group management frame encryption support or enablement is defined in a RSN extension element (RSNXE) or another capabilities element. In Example 13, the device of Example 1, the logic circuitry further configured to encrypt the group addressed management frames for transmission in a first basic service set (BSS) with a management frame group temporal key (MFGTK), and to encrypt the group addressed management frames for transmission in a second BSS with a group temporal key (GTK) of the set of one or more keys.

Example 14 is a non-transitory computer-readable medium storing computer-executable instructions which when executed by one or more processors, result in performing operations to generate a management frame comprising a robust security network (RSN) element (RSNE), the management frame comprising a cipher suite field with a cipher suite used together with a set of one or more keys to encrypt the group addressed management frames; and cause transmission of the management frame to one or more stations (STAs). In Example 15, the non-transitory computer-readable medium of Example 14, wherein the RSNE comprises the cipher suite field, the cipher suite field to indicate the cipher suite for encryption for the group addressed management frames, the cipher suite to indicate a cipher-block chaining message protocol (CCMP) or a Galois/counter mode (GCM) protocol (GCMP) to indicate use of encryption for the group addressed management frames. In Example 16, the non-transitory computer-readable medium of Example 15, wherein a group management cipher suite field of the RSNE comprises the cipher suite used together with the set of one or more keys for encryption of the group addressed management frames. In Example 17, the non-transitory computer-readable medium of Example 14, wherein the cipher suite used together with the set of one or more keys for encryption of the group addressed management frames is defined in a RSN extension element (RSNXE) in the management frame. In Example 18, the non-transitory computer-readable medium of Example 14, the operations further to cause transmission of a management frame group temporal key (MFGTK) in a key field of a MFGTK key descriptor element (KDE) or a MFGTK in a key field of a MFGTK subelement. In Example 19, the non-transitory computer-readable medium of Example 18, wherein the MFGTK KDE or MFGTK subelement comprises a linkID field for multi-link operation (MLO). In Example 20, the non-transitory computer-readable medium of Example 18, wherein the MFGTK subelement is defined under a Fast basic service set (BSS) Transition element (FTE) or a wireless network management (WNM) Sleep Mode Response frame. In Example 21, the non-transitory computer-readable medium of Example 14, wherein the group addressed management frames comprise beacon frames, probe response frames, fast initial link setup (FILS) discovery frames, open programmability system (OPS) frames, disassociation frames, and deauthentication frames. In Example 22, the non-transitory computer-readable medium of Example 14, wherein the management frame comprises a capability bit to indicate that encryption of the group addressed management frames is supported or is enabled. In Example 23, the non-transitory computer-readable medium of Example 14, wherein the cipher suite used together with the set of one or more keys indicates CCMP-128, CCMP-256, GCMP-128, or GCMP-256 for encryption of the group addressed management frames. In Example 24, the non-transitory computer-readable medium of Example 14, wherein a capability bit to indicate group management frame encryption support or enablement is defined in a RSN extension element (RSNXE) or another capabilities element. In Example 25, the non-transitory computer-readable medium of Example 14, the operations further to encrypt the group addressed management frames for transmission in a first basic service set (BSS) with a management frame group temporal key (MFGTK), and to encrypt the group addressed management frames for transmission in a second BSS with a group temporal key (GTK) of the set of one or more keys.

Example 26 is a method comprising generating a management frame comprising a robust security network (RSN) element (RSNE), the management frame comprising a cipher suite field with a cipher suite used together with a set of one or more keys to encrypt the group addressed management frames; and causing transmission of the management frame to one or more stations (STAs). In Example 27, the method of Example 26, wherein the RSNE comprises the cipher suite field, the cipher suite field to indicate the cipher suite for encryption for the group addressed management frames, the cipher suite to indicate a cipher-block chaining message protocol (CCMP) or a Galois/counter mode (GCM) protocol (GCMP) to indicate use of encryption for the group addressed management frames. In Example 28, the method of Example 27, wherein a group management cipher suite field of the RSNE comprises the cipher suite used together with the set of one or more keys for encryption of the group addressed management frames. In Example 29, the method of Example 26, wherein the cipher suite used together with the set of one or more keys for encryption of the group addressed management frames is defined in a RSN extension element (RSNXE) in the management frame. In Example 30, the method of Example 26, further comprising causing transmission of a management frame group temporal key (MFGTK) in a key field of a MFGTK key descriptor element (KDE) or a MFGTK in a key field of a MFGTK subelement. In Example 31, the method of Example 30, wherein the MFGTK KDE or MFGTK subelement comprises a linkID field for multi-link operation (MLO). In Example 32, the method of Example 30, wherein the MFGTK subelement is defined under a Fast basic service set (BSS) Transition element (FTE) or a wireless network management (WNM) Sleep Mode Response frame. In Example 33, the method of Example 26, wherein the group addressed management frames comprise beacon frames, probe response frames, fast initial link setup (FILS) discovery frames, open programmability system (OPS) frames, disassociation frames, and deauthentication frames. In Example 34, the method of Example 26, wherein the management frame comprises a capability bit to indicate that encryption of the group addressed management frames is supported or is enabled. In Example 35, the method of Example 26, wherein the cipher suite used together with the set of one or more keys indicates CCMP-128, CCMP-256, GCMP-128, or GCMP-256 for encryption of the group addressed management frames. In Example 36, the method of Example 26, wherein a capability bit to indicate group management frame encryption support or enablement is defined in a RSN extension element (RSNXE) or another capabilities element. In Example 37, the method of Example 26, further comprising encrypting the group addressed management frames for transmission in a first basic service set (BSS) with a management frame group temporal key (MFGTK), and to encrypt the group addressed management frames for transmission in a second BSS with a group temporal key (GTK) of the set of one or more keys.

Example 38 is an apparatus comprising a means for generating a group addressed management frame comprising one or more fields to carry inform associated with one or more station devices (STAs);a means for encrypting the group addressed management frame using one or more keys; and a means for causing to transmit the group addressed management frame to the one or more STAs. In Example 39, the apparatus of Example 38, wherein the RSNE comprises the cipher suite field, the cipher suite field to indicate the cipher suite for encryption for the group addressed management frames, the cipher suite to indicate a cipher-block chaining message protocol (CCMP) or a Galois/counter mode (GCM) protocol (GCMP) to indicate use of encryption for the group addressed management frames. In Example 40, the apparatus of Example 39, wherein a group management cipher suite field of the RSNE comprises the cipher suite used together with the set of one or more keys for encryption of the group addressed management frames. In Example 41, the apparatus of Example 38, wherein the cipher suite used together with the set of one or more keys for encryption of the group addressed management frames is defined in a RSN extension element (RSNXE) in the management frame. In Example 42, the apparatus of Example 38, further comprising a means for causing transmission of a management frame group temporal key (MFGTK) in a key field of a MFGTK key descriptor element (KDE) or a MFGTK in a key field of a MFGTK subelement. In Example 43, the apparatus of Example 42, wherein the MFGTK KDE or MFGTK subelement comprises a linkID field for multi-link operation (MLO). In Example 44, the apparatus of Example 42, wherein the MFGTK subelement is defined under a Fast basic service set (BSS) Transition element (FTE) or a wireless network management (WNM) Sleep Mode Response frame. In Example 45, the apparatus of Example 38, wherein the group addressed management frames comprise beacon frames, probe response frames, fast initial link setup (FILS) discovery frames, open programmability system (OPS) frames, disassociation frames, and deauthentication frames. In Example 46, the apparatus of Example 38, wherein the management frame comprises a capability bit to indicate that encryption of the group addressed management frames is supported or is enabled. In Example 47, the apparatus of Example 38, wherein the cipher suite used together with the set of one or more keys indicates CCMP-128, CCMP-256, GCMP-128, or GCMP-256 for encryption of the group addressed management frames. In Example 48, the apparatus of Example 38, wherein a capability bit to indicate group management frame encryption support or enablement is defined in a RSN extension element (RSNXE) or another capabilities element. In Example 49, the apparatus of Example 38, further comprising a means for encrypting the group addressed management frames for transmission in a first basic service set (BSS) with a management frame group temporal key (MFGTK), and to encrypt the group addressed management frames for transmission in a second BSS with a group temporal key (GTK) of the set of one or more keys.

Example 50 is an apparatus comprising a memory; and logic circuitry coupled with the memory to receive a management frame comprising a robust security network (RSN) element (RSNE), the management frame comprising a cipher suite field with a cipher suite used together with a set of one or more keys to encrypt the group addressed management frames; and decode the management frame to determine the cipher suite used together with the set of one or more keys for encryption of group addressed management frames. In Example 51, the apparatus of Example 50, wherein the logic circuitry comprises baseband processing circuitry and further comprising a radio coupled with the baseband processing circuitry, and one or more antennas coupled with the radio to receive the management frame. In Example 52, the apparatus of Example 50, the logic circuitry further configured to define a replay counter to check for replay of the encrypted group addressed management frames. In Example 53, the apparatus of Example 50, wherein the RSNE comprises the cipher suite field, the cipher suite field to indicate the cipher suite for encryption for the group addressed management frames, the cipher suite to indicate a cipher-block chaining message protocol (CCMP) or a Galois/counter mode (GCM) protocol (GCMP) to indicate use of encryption for the group addressed management frames. In Example 54, the apparatus of Example 53, wherein a group management cipher suite field of the RSNE comprises the cipher suite used together with the set of one or more keys for encryption of the group addressed management frames. In Example 55, the apparatus of Example 50, wherein the cipher suite used together with the set of one or more keys for encryption of the group addressed management frames is defined in a RSN extension element (RSNXE) in the management frame. In Example 56, the apparatus of Example 50, the logic circuitry further configured to decode a management frame group temporal key (MFGTK) in a key field of a MFGTK key descriptor element (KDE) or a MFGTK in a key field of a MFGTK subelement. In Example 57, the apparatus of Example 56, wherein the MFGTK KDE or the MFGTK subelement comprises a linkID field for multi-link operation (MLO). In Example 58, the apparatus of Example 56, wherein the MFGTK subelement is defined under a Fast basic service set (BSS) Transition element (FTE) or a wireless network management (WNM) Sleep Mode Response frame. In Example 59, the apparatus of Example 50, wherein the group addressed management frames comprise beacon frames, probe response frames, fast initial link setup (FILS) discovery frames, open programmability system (OPS) frames, disassociation frames, and deauthentication frames. In Example 60, the apparatus of Example 50, wherein the management frame comprises a capability bit to indicate that encryption of the group addressed management frames is supported or is enabled. In Example 61, the apparatus of Example 50, wherein the cipher suite for the set of one or more keys indicates CCMP-128, CCMP-256, GCMP-128, or GCMP-256 for encryption of the group addressed management frames. In Example 62, the apparatus of Example 50, wherein a capability bit to indicate group management frame encryption support or enablement is defined in a RSN extension element (RSNXE) or another capabilities element. In Example 63, the apparatus of Example 50, the logic circuitry further configured to decrypt the group addressed management frames with a management frame group temporal key (MFGTK) of the set of one or more keys. In Example 64, the apparatus of Example 50, the logic circuitry further configured to decrypt the group addressed management frames with a group temporal key (GTK) of the set of one or more keys.

Example 65 is a method comprising receiving a management frame comprising a robust security network (RSN) element (RSNE), the management frame comprising a cipher suite field with a cipher suite used together with a set of one or more keys to encrypt the group addressed management frames; and decoding the management frame to determine the cipher suite used together with the set of one or more keys for encryption of group addressed management frames. In Example 66, the method of Example 65, further comprising defining a replay counter to check for replay of the encrypted group addressed management frames. In Example 67, the method of Example 65, wherein the RSNE comprises the cipher suite field, the cipher suite field to indicate the cipher suite for encryption for the group addressed management frames, the cipher suite to indicate a cipher-block chaining message protocol (CCMP) or a Galois/counter mode (GCM) protocol (GCMP) to indicate use of encryption for the group addressed management frames. In Example 68, the method of Example 67, wherein a group management cipher suite field of the RSNE comprises the cipher suite used together with the set of one or more keys for encryption of the group addressed management frames. In Example 69, the method of Example 65, wherein the cipher suite used together with the set of one or more keys for encryption of the group addressed management frames is defined in a RSN extension element (RSNXE) in the management frame. In Example 70, the method of Example 65, further comprising decoding a management frame group temporal key (MFGTK) in a key field of a MFGTK key descriptor element (KDE) or a MFGTK in a key field of a MFGTK subelement. In Example 71, the method of Example 70, wherein the MFGTK KDE or the MFGTK subelement comprises a linkID field for multi-link operation (MLO). In Example 72, the method of Example 70, wherein the MFGTK subelement is defined under a Fast basic service set (BSS) Transition element (FTE) or a wireless network management (WNM) Sleep Mode Response frame. In Example 73, the method of Example 65, wherein the group addressed management frames comprise beacon frames, probe response frames, fast initial link setup (FILS) discovery frames, open programmability system (OPS) frames, disassociation frames, and deauthentication frames. In Example 74, the method of Example 65, wherein the management frame comprises a capability bit to indicate that encryption of the group addressed management frames is supported or is enabled. In Example 75, the method of Example 65, wherein the cipher suite for the set of one or more keys indicates CCMP-128, CCMP-256, GCMP-128, or GCMP-256 for encryption of the group addressed management frames. In Example 76, the method of Example 65, wherein a capability bit to indicate group management frame encryption support or enablement is defined in a RSN extension element (RSNXE) or another capabilities element. In Example 77, the method of Example 65, further comprising decrypting the group addressed management frames with a management frame group temporal key (MFGTK) of the set of one or more keys. In Example 78, the method of Example 65, further comprising decrypting the group addressed management frames with a group temporal key (GTK) of the set of one or more keys.

Example 79 is an apparatus comprising a means for receive a management frame comprising a robust security network (RSN) element (RSNE), the management frame comprising a cipher suite field with a cipher suite used together with a set of one or more keys to encrypt the group addressed management frames; and a means for decoding the management frame to determine the cipher suite used together with the set of one or more keys for encryption of group addressed management frames. In Example 80, the apparatus of Example 79, wherein the logic circuitry comprises baseband processing circuitry and further comprising a radio coupled with the baseband processing circuitry, and one or more antennas coupled with the radio to transmit the second PPDU. In Example 81, the apparatus of Example 79, further comprising a means for defining a replay counter to check for replay of the encrypted group addressed management frames. In Example 82, the apparatus of Example 79, wherein the RSNE comprises the cipher suite field, the cipher suite field to indicate the cipher suite for encryption for the group addressed management frames, the cipher suite to indicate a cipher-block chaining message protocol (CCMP) or a Galois/counter mode (GCM) protocol (GCMP) to indicate use of encryption for the group addressed management frames. In Example 83, the apparatus of Example 82, wherein a group management cipher suite field of the RSNE comprises the cipher suite used together with the set of one or more keys for encryption of the group addressed management frames. In Example 84, the apparatus of Example 79, wherein the cipher suite used together with the set of one or more keys for encryption of the group addressed management frames is defined in a RSN extension element (RSNXE) in the management frame. In Example 85, the apparatus of Example 79, further comprising a means for decoding a management frame group temporal key (MFGTK) in a key field of a MFGTK key descriptor element (KDE) or a MFGTK in a key field of a MFGTK subelement. In Example 86, the apparatus of Example 85, wherein the MFGTK KDE or the MFGTK subelement comprises a linkID field for multi-link operation (MLO). In Example 87, the apparatus of Example 85, wherein the MFGTK subelement is defined under a Fast basic service set (BSS) Transition element (FTE) or a wireless network management (WNM) Sleep Mode Response frame. In Example 88, the apparatus of Example 79, wherein the group addressed management frames comprise beacon frames, probe response frames, fast initial link setup (FILS) discovery frames, open programmability system (OPS) frames, disassociation frames, and deauthentication frames. In Example 89, the apparatus of Example 79, wherein the management frame comprises a capability bit to indicate that encryption of the group addressed management frames is supported or is enabled. In Example 90, the apparatus of Example 79, wherein the cipher suite for the set of one or more keys indicates CCMP-128, CCMP-256, GCMP-128, or GCMP-256 for encryption of the group addressed management frames. In Example 91, the apparatus of Example 79, wherein a capability bit to indicate group management frame encryption support or enablement is defined in a RSN extension element (RSNXE) or another capabilities element. In Example 92, the apparatus of Example 79, further comprising a means for decrypting the group addressed management frames with a management frame group temporal key (MFGTK) of the set of one or more keys. In Example 93, the apparatus of Example 79, further comprising a means for decrypting the group addressed management frames with a group temporal key (GTK) of the set of one or more keys.